CVE-2026-60010

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository, even when the RepoAdminChangeTeamAccess restriction is disabled. The endpoint fails to enforce the organization's restriction on repository administrators changing team access, enabling unauthorized modifications to the organization teams that have repository access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.