Gitea API team demotion does not update team unit permissions
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.
Summary
Changing an organization team's permission through the API with only the permission field did not rebuild the team's per-unit access or apply the requested level as a cap. After an organization owner demoted a team from admin to read, its members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected. Gitea versions from 0 through 1.27.3 are affected, and no fix is listed.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version is listed. Until one is available, change team permissions through the web form, which was not affected, and check the unit permissions of members of any team demoted through the API.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Timeline
- 2026-10-06 Threatist record created from CVE-2026-103504
- 2026-10-07 CVSS score added · CISA ADP
- 2026-10-07 CISA SSVC decision points changed
References
More Gitea vulnerabilities
- TI-2026-42785 Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. KEVCVSS 3.1CRITICAL 9.8
- TI-2026-42033 Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts CVSS 3.1CRITICAL 9.8
- TI-2026-40842 Privilege Escalation via Access Token Scope Escalation in API CVSS 3.1CRITICAL 9.8
- TI-2026-16922 Gitea Docker image trusts spoofable reverse-proxy headers by default CVSS 3.1CRITICAL 9.8
- TI-2026-42043 Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting CVSS 3.1CRITICAL 9.1
- TI-2026-40381 OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token Scopes CVSS 3.1CRITICAL 9.1
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences