Gitea private repository access retained after rejected transfer
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved.
CVE-2026-96589
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-96589
Gitea
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "Gitea",
"product": "Gitea",
"versions": [
{
"status": "affected",
"version": "0",
"versionType": "semver",
"lessThanOrEqual": "1.27.3"
}
],
"packageName": "gitea.dev",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-96589
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #11880 · Revision 1
- Added to Heist Feed
- Publisher date