CVE-2026-73814: 
Gitea vulnerability analysis and mitigation

CVE-2026-73814 is a privilege escalation vulnerability in Gitea titled "Admin repository collaborator can self-escalate to Owner and transfer the repository." An authenticated repository collaborator with Admin access can promote their effective permissions to Owner by submitting mode=4 to the collaboration access-mode endpoint, then perform owner-only operations such as transferring the repository to their own account. All Gitea versions up to and including 1.27.1 are affected; the issue was patched in version 1.27.2, released on August 14, 2026. It carries a CVSS v3.1 base score of 6.5 (Moderate) (Gitea Advisory).

The root cause is CWE-266 (Incorrect Privilege Assignment): the web handler in routers/web/repo/setting/collaboration.go passes the user-submitted uid and mode values directly to ChangeCollaborationAccessMode without adequately restricting the accepted range (Gitea Advisory). The model's validation logic in models/repo/collaboration.go only rejects values greater than AccessModeOwner (mode > perm.AccessModeOwner), meaning mode=4 (which equals AccessModeOwner) is accepted and written to both collaboration.mode and the effective access.mode (Gitea Advisory). Owner-level permission checks then rely on this effective access mode, granting the attacker full owner privileges. Exploitation requires the attacker to already hold Admin collaborator access to the target repository — it is not exploitable by unauthenticated users or those with lower permission levels (GitHub PR #38894).

A successful exploit allows an Admin collaborator to gain effective Owner permissions over any repository to which they have been granted Admin access, enabling owner-only operations including transferring the repository to the attacker's own account (Gitea Advisory). The vulnerability affects both organization-owned and user-owned repositories, meaning private repositories can be hijacked. The primary impact is on integrity and availability — the original owner loses control of the repository — while confidentiality impact is rated None in the CVSS assessment (Gitea Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability was confirmed on Gitea 1.27.1 and reported by researcher martindukek (Gitea Advisory). Exploitation requires authenticated access with Admin collaborator privileges, which limits the attack surface to trusted-but-malicious insiders or compromised collaborator accounts. No EPSS score or CISA KEV catalog entry is currently associated with this CVE.

1. Obtain Admin collaborator access: The attacker must already be granted Admin-level collaborator access to the target Gitea repository by the repository owner.
2. Identify the collaboration access-mode endpoint: Locate the API or web endpoint responsible for updating collaborator permissions, typically accessible via the repository settings collaboration page.
3. Craft a malicious request: Submit an HTTP POST request to the collaboration access-mode endpoint with the parameters uid=<attacker_user_id> and mode=4, where mode=4 corresponds to AccessModeOwner (Gitea Advisory).
4. Privilege escalation confirmed: The server accepts mode=4 due to insufficient validation and writes Owner-level permissions to both collaboration.mode and the effective access.mode for the attacker's account.
5. Perform owner-only operations: With effective Owner permissions, the attacker can now initiate a repository transfer to their own account, effectively taking over the repository and locking out the original owner (Gitea Advisory).

• Logs: Gitea access logs showing POST requests to the collaboration access-mode endpoint (e.g., /<owner>/<repo>/settings/collaboration) with a mode=4 parameter from a non-owner collaborator account.
• Logs: Audit log entries recording an unexpected change of a collaborator's access mode to Owner (mode value 4) for a repository.
• Logs: Repository transfer events initiated by a user who is not the original repository owner, particularly shortly after a collaboration permission change.
• Application State: Unexpected appearance of a collaborator account listed as Owner or with Owner-equivalent permissions in repository settings.
• Application State: Repository ownership records showing a transfer to a collaborator's account without explicit action by the original owner (Gitea Advisory).

Gitea has released version 1.27.2 (August 14, 2026) which fixes this vulnerability by correcting the validation logic in the collaboration access-mode handler to prevent collaborators from assigning themselves Owner-level permissions (Gitea Release v1.27.2, GitHub PR #38895). All users running Gitea 1.27.1 or earlier should upgrade to 1.27.2 immediately. As a short-term workaround where upgrading is not immediately possible, administrators should audit existing collaborator permissions and avoid granting Admin-level access to untrusted users until the patch is applied.

The vulnerability was disclosed via a GitHub Security Advisory (GHSA-h62v-wmrr-5qjq) published by Gitea maintainer bircni on August 14, 2026, and credited to reporter martindukek (Gitea Advisory). The fix was merged quickly — within approximately one day of the initial pull request — and included as a security fix in the Gitea 1.27.2 release, which received positive community reception with 38 reactions on the release page (Gitea Release v1.27.2). No significant broader media coverage or notable researcher commentary beyond the official advisory has been identified.