CVE-2026-96589

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description When a private repository is transferred to a user who lacks access, the system grants the recipient temporary read access as a collaborator for review purposes. If the transfer is rejected or cancelled, this collaboration is not revoked, allowing the recipient to maintain persistent read access to the private repository, including its code, issues, pull requests, and wiki, and enabling them to clone the repository without notifying the owner.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.