CVE-2026-96589

Executive Summary

CVE-2026-96589 is an improper-access-revocation flaw (CWE-672) in Gitea in which a rejected or cancelled private-repository transfer failed to remove the temporary collaborator access granted to the intended recipient. As a result, a user who was named as the transfer recipient but declined (or abandoned) the transfer retained persistent read access to the private repository, including its code, issues, pull requests, and wiki, and could still clone it — all without notifying the repository owner. Any Gitea instance hosting private repositories and using the transfer workflow is potentially affected; the defect enables unauthorized long-term disclosure of proprietary source code and project data.

Technical Analysis

Gitea supports transferring ownership of a repository from one user or organization to another. When a private repository is transferred to a user who does not already have access to it, the platform grants that named recipient temporary read access as a collaborator so that the recipient can inspect the repository and decide whether to accept the transfer. This is intended as a short-lived review window.

The defect lies in the lifecycle of that transfer-granted collaboration. Per the NVD description, rejecting or cancelling the transfer did not revoke this collaboration. The authorization state transition that should have removed the temporary collaborator entry on rejection/cancellation is missing — a classic instance of CWE-672 ("Operation on a Resource after Expiration or Release"), where a privilege that was scoped to a bounded, ephemeral workflow outlives that workflow.

The consequence is a persistent over-privilege condition:

• The named recipient continues to hold read access to the private repository after the transfer is declined or cancelled.
• The retained access covers repository code, issues, pull requests, and wiki.
• The recipient can clone the repository, meaning the entire git object history can be exfiltrated offline, outside of any future access revocation.
• The repository owner was not notified of the grant or its persistence, eliminating the chance for a human-in-the-loop detection of the dangling collaborator.

The fix described in the NVD entry changes revocation semantics: transfer-granted access is now removed on rejection/cancellation, while collaborations that predated the transfer are preserved (i.e., the fix correctly distinguishes ephemeral transfer-granted access from legitimate pre-existing collaborator relationships, avoiding an over-broad revocation that would have broken normal shared-repository workflows).

There is no disclosed evidence of authentication bypass, remote code execution, or privilege escalation beyond the granted read scope. The issue is an authorization-state / access-revocation defect, not a memory-safety or injection flaw. No affected version range, commit hash, or vendor advisory is present in the provided data.

Exploitation Scenarios

No public PoC, exploit code, or Nuclei template is known for this CVE. The attack chain below is inferred strictly from the vulnerability class (improper access revocation) and the explicit facts in the NVD description.

1) Reconnaissance / target identification. An actor operating on a Gitea instance — a legitimate user account, a compromised low-privilege account, or an insider — identifies or is named as the recipient of a private-repository transfer. The recipient must be explicitly named in the transfer request to be placed into the vulnerable collaborator state.

2) Triggering the flaw class. When the private repository is transferred to a user who lacks prior access, Gitea creates the temporary collaborator read grant. The attacker (or the named but non-consenting recipient) then rejects or cancels the transfer. The authorization-revocation step that should fire on rejection/cancellation does not execute, so the temporary collaborator entry survives. No exploit payload, malformed request, or code injection is required — the trigger is ordinary, supported workflow usage.

3) Access retention / "execution." The dangling collaborator relationship is now equivalent to a standing read grant. The recipient accesses the private repository through normal Gitea interfaces (web UI and git operations) and/or clones it. Cloning is the decisive action: it copies the full repository to a location outside Gitea's authorization boundary, so any subsequent revocation cannot claw the data back.

4) Post-exploitation impact. The recipient retains read access to code, issues, pull requests, and wiki for as long as the orphaned collaborator entry persists. Because the repository owner was not notified, the dangling access is unlikely to be noticed during routine review. The stolen content supports downstream code theft, intellectual-property exfiltration, credential/secret harvesting from repository history or wiki, and reconnaissance for follow-on campaigns. There is no evidence in the provided data of write, delete, or administrative capability being obtained.

Impact Assessment

Confidentiality: High. Private source code, issues, pull requests, wiki content, and full cloneable git history can be accessed and copied by a party the owner believes has no remaining access. This is a durable (persistent) exposure, not a single-transaction leak, so the volume of disclosed data can grow over time as the repository evolves.

Integrity and Availability: None established from the description; the flaw grants read access only, and no modification or disruption capability is described.

Attack vector: Network (Gitea is reachable over HTTP/HTTPS), low complexity (the flaw is triggered by normal transfer rejection/cancellation), privileges required: Low (the actor needs a valid account that is named as a transfer recipient), no user interaction required by the victim owner for the access to persist.

Blast radius. Any Gitea deployment that uses repository transfers for private repositories is in scope. The exposed asset is the specific repository involved in the cancelled/rejected transfer, but an insider or multi-repository actor could accumulate multiple dangling grants over time. Because cloned data escapes platform controls, the effective blast radius for each affected repository is unbounded once a clone occurs. Organizations subject to IP-protection, compliance, or data-residency obligations face regulatory and contractual exposure in addition to direct intellectual-property loss.

Exploitation likelihood. No public exploit exists and CISA KEV does not list this CVE. However, the attack requires no tooling — only the standard transfer-decline workflow — so the barrier to exploitation is operational/human rather than technical.

Detection Guidance

Because exploitation uses legitimate Gitea functionality, detection centers on anomalous persistence of collaborator relationships and unexpected clone activity rather than on malicious payloads.

Sigma Rule

title: Gitea Repository Transfer Rejected or Cancelled with Retained Collaborator Access
id: 8f3c1a52-9d47-4b1e-a6c2-7e5f0d9a1b34
status: experimental
description: Detects Gitea repository transfer rejection/cancellation events where the named recipient may retain collaborator access to a private repository (CVE-2026-96589).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-96589
author: valtersit.com
date: 2026/01/01
logsource:
  product: gitea
  service: audit
detection:
  selection_transfer:
    action|contains:
      - 'repo.transfer'
      - 'transfer.reject'
      - 'transfer.cancel'
  selection_user:
    actor|contains: '@'
  condition: selection_transfer and selection_user
falsepositives:
  - Legitimate repository transfers that are correctly accepted
  - Administrative cleanup of stale transfer requests
level: medium
tags:
  - attack.t1213
  - cve.2026.96589

YARA Rule

rule CVE_2026_96589_Gitea_Transfer_Access_Artifact
{
    meta:
        description = "Detects Gitea application/DB artifacts referencing transfer-granted collaboration state associated with CVE-2026-96589"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-96589"
        date = "2026-01-01"
        severity = "high"

    strings:
        $transfer = "repo_transfer" ascii wide nocase
        $collab   = "collaboration" ascii wide nocase
        $reject   = "reject" ascii wide nocase
        $cancel   = "cancel" ascii wide nocase
        $gitea    = "gitea" ascii wide nocase

    condition:
        $gitea and $transfer and $collab and 1 of ($reject, $cancel)
}

Note: This is a heuristic content rule for forensic triage of Gitea data/config artifacts, not a network detection. Tune strings to your deployment.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-96589 Gitea Repository Transfer Rejection Activity"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/repo/"; content:"transfer"; nocase; http.uri; content:"reject"; nocase; classtype:attempted-recon; sid:2026965890; rev:1; reference:cve,2026-96589; metadata:created_at 2026_01_01, updated_at 2026_01_01, confidence Low;)

URI fragments reflect Gitea's transfer workflow path pattern; no exact endpoint is specified in the provided data, so this rule keys on the workflow keywords and should be validated against your Gitea version's routing before production use.

Elastic Detection

sequence by user.name with maxspan=1h
  [ process where event.action == "repo_transfer_initiated" ]
  [ network where event.category == "web" and
      process.name == "gitea" and
      http.request.method == "POST" and
      stringContains(url.path, "transfer") and
      (stringContains(url.path, "reject") or stringContains(url.path, "cancel")) ]

Splunk SPL Query

index=gitea sourcetype=gitea:audit
| search ("repo.transfer" OR "transfer.reject" OR "transfer.cancel")
| rex field=_raw "(?<recipient>[A-Za-z0-9_.-]+@[A-Za-z0-9.-]+)"
| stats count min(_time) as first_seen max(_time) as last_seen values(action) as actions by recipient, repo, user
| where count >= 1
| convert ctime(first_seen) ctime(last_seen)
| sort - last_seen

Companion query to surface dangling collaborators on private repos (join against repository membership):

index=gitea sourcetype=gitea:audit action="repo.transfer.reject" OR action="repo.transfer.cancel"
| stats latest(_time) as rejected_at values(actor) as rejected_by by repo, recipient
| join type=left repo
    [ search index=gitea sourcetype=gitea:collaborator action="collaborator.add" OR action="collaborator.remove"
      | stats latest(_time) as collab_event values(action) as collab_action by repo, recipient ]
| where isnull(collab_event) OR collab_action=="collaborator.add"
| table repo, recipient, rejected_by, rejected_at, collab_action

Wazuh OSSEC Rule

<group name="gitea,cve-2026-96589,">
  <rule id="10096589" level="10">
    <decoded_as>json</decoded_as>
    <field name="action">\.+transfer\.(reject|cancel)</field>
    <description>Gitea: repository transfer rejected/cancelled - verify recipient collaborator access was revoked (CVE-2026-96589)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>

  <rule id="10096590" level="12">
    <if_sid>10096589</if_sid>
    <field name="repo.private">true</field>
    <description>Gitea: private repository transfer rejected with potential retained access - high priority review (CVE-2026-96589)</description>
    <mitre>
      <id>T1213</id>
    </mitre>
  </rule>
</group>

Field names (action, repo.private) assume JSON-formatted Gitea audit logs; adjust to your log schema before deployment.

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit, or fix version is present in the supplied data. The NVD description references a behavior change in which transfer-granted access is removed on rejection/cancellation while pre-existing collaborations are preserved, but no release identifier is available — treat all deployments as potentially affected until the vendor publishes a fix.

1) Immediate mitigations

• Audit dangling collaborators now. For every private repository, enumerate current collaborators and cross-reference against transfer rejections/cancellations. Remove any collaborator whose access originated from an unaccepted transfer.
• Manually revoke on transfer abort. Treat every rejected/cancelled transfer as requiring a manual collaborator-removal step until patched.
• Temporarily restrict repository transfers. Disable or tightly control the transfer workflow (limit who may initiate transfers) for private repositories to prevent creation of new dangling grants.
• Notify owners. Ensure repository owners are alerted to transfer initiations and rejections, since the platform does not notify them automatically.
• Assume breach for affected repos. Where a dangling grant existed, budget for remediation under the assumption that the repository may already have been cloned (rotate embedded secrets/credentials found in code, issues, or wiki).

2) Patch / upgrade steps

• No patched version is identified in the provided data. Monitor the Gitea release notes and security advisories for a fix that removes transfer-granted access on rejection/cancellation while preserving pre-existing collaborations. When published, upgrade immediately and re-verify collaborator lists post-upgrade.
• Until a fix is available, do not rely on the transfer workflow to self-clean; enforce step 1 controls operationally.

3) Long-term hardening

• Enforce least privilege on repository transfers: require explicit owner/admin approval before any access grant is created, rather than auto-granting on initiation.
• Implement periodic access reviews of private repositories; automate detection of collaborators with no corresponding accepted workflow.
• Enable comprehensive audit logging for transfer, collaborator-add, and collaborator-remove events, and forward to SIEM.
• Adopt secret scanning across code, issues, and wiki to limit the value of any future unauthorized clone.
• Configure branch/network egress controls where feasible to make bulk clones of sensitive repositories observable.

References

1. NVD — CVE-2026-96589: https://nvd.nist.gov/vuln/detail/CVE-2026-96589
2. CWE-672 — Operation on a Resource after Expiration or Release: https://cwe.mitre.org/data/definitions/672.html
3. MITRE ATT&CK T1213 — Data from Information Repositories: https://attack.mitre.org/techniques/T1213/
4. Gitea Security Advisories (monitor for fix release covering repository transfer access revocation): https://github.com/go-gitea/gitea/security/advisories
5. CISA Known Exploited Vulnerabilities Catalog (CVE-2026-96589 not listed as of this report): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Exploit-in-the-wild status: No public PoC, exploit code, Nuclei template, or CISA KEV listing exists in the provided data. No threat-actor campaigns are known or attributed. Exploitation, if observed, would appear in logs as transfer rejection/cancellation events without a corresponding collaborator removal.