CVE-2026-96589
Gitea private repository access retained after rejected transfer
Published Oct 13, 2026 · updated Oct 14, 2026
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · Tenable CVE Database
Detected
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The re
Oct 14, 2026 · GitHub Advisory Database
Fix available
gitea fixed in 28.0.0
Oct 14, 2026 · GitHub Advisory Database
Fix available
gitea fixed in 28.0.0
Oct 14, 2026 · GitHub Advisory Database
Updated
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The re
Affected
- Bitnami gitea0 → 28.0.0
Sources
- CVE.orgVulnerability recordCVE-2026-96589
Official CVE identifier
cve.org - FIRST EPSSExploitation probabilityCVE-2026-96589
30-day exploitation probability 0.2%
first.org - GitHub Advisory DatabasePackage advisoryGHSA-xfqq-h54g-92f8
GitHub Advisory Database record mirrored by OSV.
github.com - OSV.devPackage advisoryBIT-gitea-2026-96589
Gitea private repository access retained after rejected transfer
osv.dev - Tenable CVE DatabaseVulnerability recordCVE-2026-96589
When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The re
tenable.com