Skip to content
Heist/ feed
Back to feed
Medium

Gitea repository ownership escalation by administrators

Type: advisorySources: OSV

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2026-73814
Confirmed fixed CVEs
Not specified
Updated in this feed
4 Nov 2026, 02:25 UTC · Revision 1

Source evidence

Gitea repository ownership escalation by administrators

core-osv · Original source

Published 14 Oct 2026, 14:38 UTC

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

osv:CVE-2026-73814
Complete source record
{
  "id": "9327af0b06aaa01ac9ab26afce6207fd765a36d286eb7b722786d0a9ae05520b",
  "url": "https://osv.dev/vulnerability/CVE-2026-73814",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Gitea repository ownership escalation by administrators",
    "summary": "Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.",
    "evidence": "osv:CVE-2026-73814",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2026-73814",
      "aliases": [
        "CVE-2026-73814",
        "GHSA-h62v-wmrr-5qjq"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/go-gitea/gitea",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "1dac1bb2f8593d4319125fa6bca9283000a2ddc2"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.27.1"
                      }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                  },
                  {
                    "range": [
                      {
                        "fixed": "1dac1bb2f8593d4319125fa6bca9283000a2ddc2"
                      }
                    ],
                    "source": "REFERENCES_TAG",
                    "original_tag": "v1.27.2"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v1.27.1",
            "v1.27.0",
            "v1.27.0-rc0",
            "v1.28.0-dev",
            "v1.27.0-dev",
            "v1.26.0-dev",
            "v1.25.0-dev",
            "v1.24.0-dev",
            "v1.22.0-rc1",
            "v1.23.0-dev",
            "v1.22.0-rc0",
            "v1.21.0-rc0",
            "v1.22.0-dev",
            "v1.20.0-rc0",
            "v1.21.0-dev",
            "v1.20.0-dev",
            "v1.19.0-rc0",
            "v1.18.0-rc0",
            "v1.19.0-dev",
            "v1.18.0-dev",
            "v1.17.0-dev",
            "v1.16.0-rc1",
            "v1.15.0-rc1",
            "v1.16.0-dev",
            "v1.15.0-dev",
            "v1.14.0-dev",
            "v1.13.0-dev",
            "v1.12.0-dev",
            "v1.10.5",
            "v1.11.0-rc1",
            "v1.10.0-rc1",
            "v1.11.0-dev",
            "v1.9.0-rc1",
            "v1.10.0-dev",
            "v1.9.0-dev",
            "v1.7.0-dev",
            "v1.6.0-rc1",
            "v1.6.0-dev",
            "v1.5.0-rc1",
            "v1.5.0-dev",
            "v1.1.0",
            "v1.0.0",
            "v0.9.99"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-73814.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:32.407982993Z",
      "provider": "osv",
      "references": [
        "https://blog.gitea.com/release-of-1.27.2/",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73814.json",
        "https://github.com/go-gitea/gitea/releases/tag/v1.27.2",
        "https://github.com/go-gitea/gitea/security/advisories/GHSA-h62v-wmrr-5qjq",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-73814",
        "https://github.com/go-gitea/gitea/pull/38894",
        "https://github.com/go-gitea/gitea/pull/38895"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-266"
        ],
        "cna_assigner": "Gitea",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73814.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-73814",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 499648,
  "published_at": "2026-10-14T14:38:05.476+00:00"
}