CVE-2026-103504: Gitea API team demotion not applied to unit permissions

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-06 · updated 2026-10-07
Weakness: CWE-272

Description

Changing an organization team's permission through the API with only the `permission` field did not rebuild the team's per-unit access, and the requested level was not applied as a cap. After an organization owner demoted a team, for example from admin to read, the team's members kept their previous unit permissions, including write access to the team's repositories. The web form was not affected.

Affected products

Gitea Open Source Git Server: through 1.27.3

References

https://blog.gitea.com/release-of-28.0.0/
https://github.com/go-gitea/gitea/pull/38938
https://github.com/go-gitea/gitea/releases/tag/v28.0.0
https://github.com/go-gitea/gitea/security/advisories/GHSA-x8c3-3rp8-2j46

Get alerted when CVE-2026-103504 or the next vulnerability affects your stack