CVE-2026-73814 Gitea repository ownership escalation by administrators
Authenticated repository admins can escalate to owner privileges and transfer repositories, bypassing intended access boundaries in Gitea.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73814?
CVE-2026-73814 is a medium-severity vulnerability in Gitea, published on 14 Oct 2026. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.
Weakness: CWE-266
Which versions are affected by CVE-2026-73814?
How do I fix CVE-2026-73814?
No fix has been published for CVE-2026-73814 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-73814 being exploited?
There is no known exploitation of CVE-2026-73814 in the wild and no public exploit code.
Sources
Also known as GHSA-h62v-wmrr-5qjq.