CVE-2026-96589

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-96589
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96589.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-96589
Aliases
  • GHSA-xfqq-h54g-92f8
Published
2026-10-06T19:25:38Z
Modified
2026-10-09T02:31:05Z
Severity
  • 4.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Summary
Gitea private repository access retained after rejected transfer
Details

When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved.

Database specific 
{
    "cna_assigner": "Gitea",
    "cwe_ids": [
        "CWE-672",
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/96xxx/CVE-2026-96589.json"
}
References

Affected packages

Git / github.com/go-gitea/gitea

Affected ranges

Type
GIT
Repo
https://github.com/go-gitea/gitea
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
15b8a5805adf57c5189602008d38cccfd3c795e0
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.27.3"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.9.99
v1.*
v1.0.0
v1.1.0
v1.10.0-dev
v1.10.0-rc1
v1.10.5
v1.11.0-dev
v1.11.0-rc1
v1.12.0-dev
v1.13.0-dev
v1.14.0-dev
v1.15.0-dev
v1.15.0-rc1
v1.16.0-dev
v1.16.0-rc1
v1.17.0-dev
v1.18.0-dev
v1.18.0-rc0
v1.19.0-dev
v1.19.0-rc0
v1.20.0-dev
v1.20.0-rc0
v1.21.0-dev
v1.21.0-rc0
v1.22.0-dev
v1.22.0-rc0
v1.22.0-rc1
v1.23.0-dev
v1.24.0-dev
v1.25.0-dev
v1.26.0-dev
v1.27.0-dev
v1.28.0-dev
v1.5.0-dev
v1.5.0-rc1
v1.6.0-dev
v1.6.0-rc1
v1.7.0-dev
v1.9.0-dev
v1.9.0-rc1
v29.*
v29.0.0-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-96589.json"