CVE-2026-73814mediumCWE-266

CVE-2026-73814: medium-severity vulnerability in Gitea

Gitea repository ownership escalation by administrators

Published · Updated

Follow this CVE+ Monitor Gitea

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.5%
Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected products
Gitea · Gitea
Related CVEs — Gitea

In the same product, most dangerous first.

CVE-2026-60004CRITICALCVE-2026-60004EPSS 24.0%KEVCVE-2026-59774CRITICALGitea Org-mode file disclosure and code executionEPSS 28.3%CVE-2019-1010314—CVE-2019-1010314EPSS 0.8%CVE-2019-1010261—CVE-2019-1010261EPSS 0.8%CVE-2026-94205CRITICALGitea fork workflow approval bypass through maintainer-triggered eventsEPSS 0.6%CVE-2026-96404HIGHGitea installer authentication bypass for existing accountsEPSS 0.6%