CVE-2026-96589— Gitea private repository access retained after rejected transfer
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当私有仓库被转移给一位没有访问权限的用户时，Gitea 会临时授予该接收者“协作者”身份，以便其可以查看该仓库。如果接收者拒绝或取消该转移请求，之前授予的协作者权限并未被撤销，导致该指定接收者持续保留对该私有仓库的只读访问权限，包括代码、问题（Issues）、拉取请求（Pull Requests）和 Wiki，并且仍可克隆该仓库。而仓库所有者并未收到任何通知。 目前，通过转移操作获得的访问权限将在转移过程中被移除，而转移之前已存在的协作关系则会被保留。
Possible ATT&CK Techniques 1 AI
T1078 · Valid Accounts
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-96589
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea private repository access retained after rejected transfer
Source: CVE Program / CVE List V5
Vulnerability Description
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
在过期或释放后对资源进行操作
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-96589
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-96589
请登录查看更多情报信息。
Other References for CVE-2026-96589 (4)
-
https://github.com/go-gitea/gitea/releases/tag/v28.0.0 release-notes
-
https://blog.gitea.com/release-of-28.0.0/ release-notes
Same Patch Batch · Gitea · 2026-10-06 · 21 CVEs total
| CVE-2026-104636 | Gitea SSRF through Git HTTP redirects in mirrors and fetches | |
| CVE-2026-73278 | Gitea WebAuthn bypass during OAuth and OIDC sign-in | |
| CVE-2026-79960 | Gitea deploy key pushes acting as the repository owner | |
| CVE-2026-70357 | Gitea repository migration SSRF through DNS rebinding | |
| CVE-2026-96580 | Gitea Actions memory exhaustion through large static matrices | |
| CVE-2026-96400 | Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS | |
| CVE-2026-96399 | Gitea denial of service through external issue tracker patterns | |
| CVE-2026-96404 | Gitea installer authentication bypass for existing accounts | |
| CVE-2026-104626 | Gitea fork workflow job revival through later approval | |
| CVE-2026-104632 | Gitea fork workflow approval bypass through cancel and rerun | |
| CVE-2026-94205 | Gitea fork workflow approval bypass through maintainer-triggered events | |
| CVE-2026-101027 | Gitea migration SSRF through ALLOWED_DOMAINS address check bypass | |
| CVE-2026-101029 | Gitea migration and pull mirror SSRF through multi-answer DNS | |
| CVE-2026-95106 | Gitea review and execution mismatch through duplicate tree entries | |
| CVE-2026-95112 | Gitea issue reference parsing CPU exhaustion | |
| CVE-2026-89430 | Gitea push mirror SSRF and forced writes to internal Git hosts | |
| CVE-2026-103504 | Gitea API team demotion not applied to unit permissions | |
| CVE-2026-103667 | Gitea container registry stored XSS through blob media type | |
| CVE-2026-103059 | Gitea built-in SSH server authentication bypass through key case folding | |
| CVE-2026-103670 | Gitea trusted workflow cancellation by unapproved fork runs |
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96580
Gitea Actions memory exhaustion through large static matrice -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D -
CVE-2026-96399
Gitea denial of service through external issue tracker patte
Same vendor: Gitea
-
CVE-2026-73278
Gitea WebAuthn bypass during OAuth and OIDC sign-in -
CVE-2026-96580
Gitea Actions memory exhaustion through large static matrice -
CVE-2026-96404
Gitea installer authentication bypass for existing accounts -
CVE-2026-96400
Gitea migration SSRF to reserved addresses through ALLOWED_D -
CVE-2026-96399
Gitea denial of service through external issue tracker patte
V. Comments for CVE-2026-96589
No comments yet