CVE-2026-58433

CriticalCVSS 9.1

Published: 13/08/2026(UTC)Updated: 14/08/2026(UTC)Translated: 13/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.16%

5th percentile - higher than 5% of all known CVEs

Summary

The team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting. This means a user without proper permissions can change repository-team assignments.

Risk Assessment

This can lead to unauthorized changes in team and repository structure, potentially compromising access control and organizational integrity.

Recommendation

Update Gitea to a patched version and verify organization permission settings. Monitor changes in repository-team assignments.

Original NVD description (English source)

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting