A critical authorization bypass vulnerability in Gitea allows unauthorized actors to manipulate team-repository access settings, potentially exposing sensitive source code and data.

This vulnerability, identified as CWE-862 (Missing Authorization), occurs within the team-repository linking endpoint. It allows unauthenticated users to bypass the RepoAdminChangeTeamAccess organization setting and modify access permissions for repositories.

The ability for an unauthenticated attacker to manipulate repository permissions presents a severe threat to intellectual property and code integrity. Successful exploitation could lead to unauthorized access to proprietary source code or the modification of project structures, potentially resulting in significant reputational damage and data theft. Given the CVSS score of 9.1, this vulnerability is classified as critical due to its ease of exploitation and the potential for widespread unauthorized access.

Immediate Action: Upgrade Gitea to version 1.27.0 or later, as this release contains the necessary security fixes for the identified authorization flaw.

Proactive Monitoring: Review repository access logs for unusual team-linking activities or unauthorized modifications to access control lists, specifically focusing on administrative endpoints.

Compensating Controls: While a patch is available, organizations should ensure that Gitea instances are not exposed to the public internet and are protected by robust network-level access controls or VPNs to limit the attack surface.

Public Exploit Available: No (exploit_available: false).

The critical nature of this vulnerability, combined with its potential for unauthenticated exploitation, necessitates an immediate response. Administrators must prioritize the deployment of Gitea 1.27.0 across all affected environments to neutralize the risk of unauthorized repository access. Failure to patch promptly leaves the organization vulnerable to actors who may leverage the existing proof-of-concept to gain unauthorized control over repository access settings.