CVE-2026-60010

Executive Summary

CVE-2026-60010 is an authorization bypass in Gitea's repository-side team-link API. A repository administrator who is not an organization owner can attach organization teams to a repository even when the RepoAdminChangeTeamAccess setting is disabled, because the endpoint fails to enforce the organization's restriction on repository administrators changing team access. Successful exploitation grants an attacker with repository-admin privileges the ability to alter which organization teams receive access to a repository, enabling unauthorized privilege and access changes within the organization's project structure.

Technical Analysis

The vulnerability resides in Gitea's repository-side team-link API — the interface exposed to repository administrators for associating organization teams with a specific repository. Gitea's authorization model distinguishes between organization owners and repository administrators. The RepoAdminChangeTeamAccess setting exists to prevent repository administrators (who are not organization owners) from modifying which teams are granted access to a repository. This is a deliberate privilege boundary: team-to-repository linkage controls who inside the organization can read, write, or administer the affected repository, and it is normally the organization owner's prerogative to decide it.

Per the NVD description, the repository-side team-link endpoint "does not enforce the organization's restriction on repository administrators changing team access." The access-control decision that should gate the operation is missing or incorrectly scoped, so the intended restriction (driven by RepoAdminChangeTeamAccess) is never applied to requests reaching this endpoint. This is classified as CWE-266 (Incorrect Privilege Assignment): a user holding repository-admin rights is effectively granted a capability reserved for organization owners.

The impact is an integrity and confidentiality concern rather than a memory-safety or code-execution issue. Because the endpoint permits unauthorized modifications to the set of organization teams attached to a repository, an attacker can add teams that should not have access. Since organization teams carry permission levels within Gitea's access model, linking a more permissive team to a target repository can expand read/write access to the repository's contents for principals the organization owner never intended to authorize. The missing control is enforced at the authorization layer, meaning no special payload, memory corruption, or injection primitive is required — the flaw is a logic/authorization gap reachable over the normal authenticated API surface.

The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N reflects a network-reachable, low-complexity attack that requires high privileges (an authenticated repository administrator) with no user interaction. It has scope-unchanged behavior, high confidentiality and high integrity impact, and no availability impact — consistent with an access-control bypass that can expose and modify repository access relationships without taking the service down. Note that the underlying vulnerability data does not identify affected version ranges, and no public PoC or exploit code is available. Attack chain details below are therefore inferred from the vulnerability class (authorization bypass via missing enforcement) rather than from a published proof of concept.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description, and avoids any function or parameter names not present in the source data.

1. Reconnaissance / target identification. The attacker needs an authenticated Gitea account that has been granted repository-administrator rights on at least one repository, but which is not an organization owner of the organization that owns that repository. The attacker enumerates candidate Gitea instances (the service self-identifies via web content and favicon) and confirms their own privilege level: they can administer a repository but are not an org owner. The key precondition is that the target organization has RepoAdminChangeTeamAccess disabled — the exact configuration the endpoint is supposed to honor.

2. Triggering the flaw class. The attacker authenticates and submits a request to the repository-side team-link API to attach an organization team to the repository they administer. Under correct operation this action should be rejected for a non-owner when RepoAdminChangeTeamAccess is disabled. Because the endpoint does not enforce that organization-level restriction, the authorization check is bypassed and the request succeeds. This is a missing-enforcement authorization bypass (CWE-266); no memory corruption or injection primitive is involved.

3. Execution method at the vulnerability-class level. The "payload" is a legitimate-looking authenticated API call that modifies the repository's team associations. There is no special syntax, encoding trick, or exploit code required — the attacker simply performs the restricted team-linking action directly. No function names, endpoint paths, or request parameters beyond "repository-side team-link API" are asserted here, as the source data does not provide them.

4. Post-exploitation impact. Having altered which organization teams are linked to the repository, the attacker can expand access to the repository for teams (and therefore team members) the organization owner never authorized. This can grant additional principals read or write access to repository contents, enabling source code exposure, unauthorized modifications, and lateral movement into related projects that share those teams. The change also undermines the organization's access-governance posture, since the repository's effective permission set no longer reflects owner intent.

Impact Assessment

The primary impact is unauthorized modification of repository access relationships (high integrity) combined with the resulting exposure of repository contents to unintended principals (high confidentiality). Availability is not affected. Because the attack requires an authenticated repository administrator, the practical blast radius is contained to organizations where such a role has been delegated — but in those environments the consequence is meaningful: an insider or a compromised repo-admin account can silently widen access to potentially sensitive source code and associated secrets. The scope is unchanged (S:U), meaning the impact is generally confined to the affected repository and its organization team graph rather than the entire platform. Organizations relying on RepoAdminChangeTeamAccess as a segregation-of-duties control between org owners and repo admins lose that guarantee for any instance affected by this flaw. The lack of a patch (confidence 0/4) and absence of a documented affected-version range increase operational risk, as defenders cannot currently pin their exposure to a specific release band.

Detection Guidance

Sigma Rule

title: Gitea Repository Team-Link Authorization Bypass (CVE-2026-60010)
id: 8f2c1b47-3a6e-4d1f-9c22-7b5e0a91d3c4
status: experimental
description: Detects successful team-to-repository linking on Gitea's repository-side
  team-link API by a non-owner repository administrator when RepoAdminChangeTeamAccess
  is disabled. Adjust field mappings to your log pipeline.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-60010
author: valtersit.com
date: 2026/01/01
logsource:
  product: gitea
  service: audit
detection:
  selection_action:
    action|contains:
      - 'team'
      - 'add_team_repository'
      - 'repo.add_team'
  selection_endpoint:
    path|contains:
      - '/teams'
      - '/repos/'
  filter_owner:
    actor_is_org_owner: true
  condition: selection_action and selection_endpoint and not filter_owner
falsepositives:
  - Legitimate organization owners modifying team access
  - Administrative automation using owner-level tokens
level: medium
tags:
  - attack.t1098
  - cve.2026.60010

YARA Rule

rule CVE_2026_60010_Gitea_Team_Access_Bypass
{
    meta:
        description = "Detects Gitea source/artifact references to the RepoAdminChangeTeamAccess control that CVE-2026-60010 fails to enforce. Tune to your codebase or log corpus."
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-60010"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $setting = "RepoAdminChangeTeamAccess" ascii wide nocase
        $teamlink = "team" ascii nocase
        $api = "repository" ascii nocase

    condition:
        $setting and 1 of ($teamlink, $api)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-60010 Gitea repository team-link API access-control bypass attempt"; flow:established,to_server; http.method; content:"PUT"; http.uri; content:"/teams"; http.uri; content:"/repos/"; reference:cve,2026-60010; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-60010; classtype:attempted-admin; sid:2026600010; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [ authentication where event.outcome == "success" and user.name != null ]
  [ http where http.request.method in ("PUT","POST","PATCH")
    and http.request.url : "*/teams*"
    and http.request.url : "*/repos/*"
    and event.action != "org_owner" ]

Splunk SPL Query

index=gitea sourcetype=gitea:audit (action="add_team_repository" OR action="team_repo_add" OR uri="*/teams*")
| where NOT match(actor_role, "(?i)owner")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as uris values(team) as teams by actor, repo, src_ip
| where count > 0
| convert ctime(first_seen) ctime(last_seen)
| sort - count

Wazuh OSSEC Rule

<group name="gitea,cve-2026-60010,">
  <rule id="202660" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">add_team_repository|team_repo_add</field>
    <field name="actor_is_org_owner">false</field>
    <description>CVE-2026-60010: Gitea team-to-repository link by non-owner repo admin (possible RepoAdminChangeTeamAccess bypass)</description>
    <mitre>
      <id>T1098</id>
    </mitre>
    <group>access_control,cve_2026_60010,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, affected-version list, or workaround is currently documented in the tracked data.

1. Immediate mitigations.

   • Minimize the number of users holding repository-administrator rights on repositories owned by organizations, since this role is the exploitation precondition.
   • Where feasible, restrict or reverse delegation of repo-admin privileges in organizations that depend on RepoAdminChangeTeamAccess for segregation of duties.
   • Apply the principle of least privilege to organization teams themselves, so that even if a team is wrongly linked, its permission level limits exposure.
   • Monitor audit logs for team-to-repository link actions performed by actors who are not organization owners (see Detection Guidance).

2. Patch / upgrade steps.

   • No patch is currently available per tracked sources. Monitor the Gitea project's release and security advisory channels and the NVD entry for CVE-2026-60010 for a fixed version.
   • Because no affected-version range is published, inventory all Gitea deployments and record their versions so you can rapidly remediate once a fix and version range are confirmed.
   • Validate any future fix by confirming the repository-side team-link API enforces the RepoAdminChangeTeamAccess restriction for non-owner repository administrators.

3. Long-term hardening.

   • Enforce strict separation between organization-owner and repository-admin roles, and periodically review team-to-repository linkages for drift.
   • Implement alerting on authorization-relevant administrative actions (team membership, team-repository links, role changes) and centralize audit logs off-instance.
   • Adopt a vulnerability-management process that tracks unpatched CVEs and re-checks vendor advisories on a defined cadence.

References

• NVD — CVE-2026-60010: https://nvd.nist.gov/vuln/detail/CVE-2026-60010
• Gitea project release and security advisories: https://github.com/go-gitea/gitea
• Gitea documentation — repository and organization permissions (RepoAdminChangeTeamAccess): https://docs.gitea.com/
• CWE-266: Incorrect Privilege Assignment — https://cwe.mitre.org/data/definitions/266.html
• MITRE ATT&CK T1098 — Account Manipulation: https://attack.mitre.org/techniques/T1098/

No threat actor campaigns, exploit-in-the-wild evidence, public PoC, or CISA KEV listing are associated with CVE-2026-60010 in the available data.