目标达成 感谢每一位支持者 — 我们达成了 100% 目标！

目标: 1000 元 · 已筹: 1359 元

100%
请我们喝杯咖啡

CVE-2026-60010— Gitea organization team policy bypass through repository API

一分钟漏洞结论

影响对象
Gitea Gitea
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。

Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction

影响版本矩阵 1

厂商产品 版本范围状态
Gitea Gitea ≤ 1.27.2 affected
获取后续新漏洞提醒 登录后订阅

一、 漏洞 CVE-2026-60010 基础信息

漏洞信息

Shenlong is analyzing...

对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗

尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。

Vulnerability Title
Gitea organization team policy bypass through repository API
来源: CVE Program / CVE List V5
Vulnerability Description
Gitea's repository-side team-link API allows a repository administrator who is not an organization owner to attach organization teams to a repository despite RepoAdminChangeTeamAccess being disabled. The endpoint does not enforce the organization's restriction on repository administrators changing team access. This allows unauthorized changes to which organization teams receive repository access.
来源: CVE Program / CVE List V5
CVSS Information
N/A
来源: CVE Program / CVE List V5
Vulnerability Type
特权授予不正确
来源: CVE Program / CVE List V5

受影响产品

厂商 产品 影响版本 CPE 订阅
Gitea Gitea 0 ~ 1.27.2 -

二、漏洞 CVE-2026-60010 的公开POC

# POC 描述 源链接 神龙链接
AI 生成 POC 高级

未找到公开 POC。

登录以生成 AI POC

三、漏洞 CVE-2026-60010 的情报信息

请登录查看更多情报信息。

CVE-2026-60010 补丁与修复 (2)

CVE-2026-60010 其他参考 (2)

CVE-2026-60010 其他参考 (1)

同批安全公告 · Gitea · 2026-10-14 · 共 36 条

CVE-2026-68964 Gitea restricted-user SSH and GPG key metadata disclosure
CVE-2026-70396 Gitea organization repository creation token scope bypass
CVE-2026-70406 Gitea private comparison disclosure with public-only tokens
CVE-2026-70400 Gitea private migration creation with public-only tokens
CVE-2026-70402 Gitea local code execution through writable Git hooks
CVE-2026-67577 Gitea restricted-user activity and heatmap disclosure
CVE-2026-63792 Gitea private reusable workflow disclosure to fork runs
CVE-2026-63021 Gitea Swift package manifest memory exhaustion
CVE-2026-62925 Gitea Alpine package parsing memory exhaustion
CVE-2026-70407 Gitea organization listing token scope bypass
CVE-2026-68957 Gitea restricted-user issue search disclosure
CVE-2026-73814 Gitea repository ownership escalation by administrators
CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target
CVE-2026-73535 Gitea second-factor bypass through OpenID identity linking
CVE-2026-73804 Gitea API token scope escalation through HTTP signatures
CVE-2026-73539 Gitea external renderer argument injection and code execution
CVE-2026-78231 Gitea blind SSRF through OpenID assertion verification
CVE-2026-78433 Gitea private attachment disclosure through repository mismatch
CVE-2026-73126 Gitea private workflow badge token scope bypass
CVE-2026-73802 Gitea Runner host isolation bypass through container options

显示前 20 条，共 36 条。 查看全部 → →

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-266

V. Comments for CVE-2026-60010

暂无评论

发表评论