{"id":"CVE-2026-103504","published":"2026-10-06T20:17:14.487","lastModified":"2026-10-07T21:17:07.427","description":"Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.","cvssScore":8.1,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-272"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/38938","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x8c3-3rp8-2j46","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/38938","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-x8c3-3rp8-2j46","tags":[]}],"hasPoc":true,"ai":{"summary":"A team's permission level was not properly enforced after API updates, allowing members to retain higher-level access than granted. This creates a privilege escalation risk where users maintain write permissions beyond their assigned team role.","exploitability":"Exploitation requires an authenticated user with team management privileges and is moderately difficult, needing API calls to modify team permissions while maintaining existing unit access.","blast_radius":"The vulnerability affects all organizations using the API for team permission changes, potentially allowing unauthorized write access to repositories and data within units where team members were demoted.","remediation":"Upgrade to version 2.590 or later to receive the patch that properly enforces team permission changes and rebuilds per-unit access.","detection":"Monitor for API calls to team permission endpoints with permission field updates, specifically looking for requests that modify team roles without rebuilding unit access permissions.","tags":["privilege-escalation","api","access-control"],"model":"garnet-coder","analyzedAt":"2026-10-14T08:58:10.771Z"}}