---
id: CVE-2026-73814
title: >-
  Gitea's collaboration access-mode endpoint accepts the Owner access mode from
  an authenticated repository collaborator with Admin access
summary: >-
  Gitea's collaboration access-mode endpoint accepts the Owner access mode from
  an authenticated repository collaborator with Admin access. The collaborator
  can promote their effective permissions from Admin to Owner and then perform
  owner…
severity: none
cwe:
  - CWE-266
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:04:39.483'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-73814'
references:
  - url: 'https://blog.gitea.com/release-of-1.27.2/'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/pull/38894'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/pull/38895'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v1.27.2'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-h62v-wmrr-5qjq'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.031Z'
---

## Overview

Gitea's collaboration access-mode endpoint accepts the Owner access mode from an authenticated repository collaborator with Admin access. The collaborator can promote their effective permissions from Admin to Owner and then perform owner-only operations, including transferring the repository to their own account. This bypasses the intended boundary between repository administration and ownership.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.