CVE-2026-96589

When a private repository is transferred to a user who lacks access, Gitea grants that recipient temporary read access as a collaborator so they can review the repository. Rejecting or cancelling the transfer did not revoke this collaboration, so the named recipient kept persistent read access to the private repository, including its code, issues, pull requests and wiki, and could clone it. The repository owner was not notified. Transfer-granted access is now removed while collaborations that existed before the transfer are preserved.

• CWE-672
• CWE-863

• https://blog.gitea.com/release-of-28.0.0/Release Notes
• https://github.com/go-gitea/gitea/pull/39042Patch
• https://github.com/go-gitea/gitea/releases/tag/v28.0.0Release Notes
• https://github.com/go-gitea/gitea/security/advisories/GHSA-xfqq-h54g-92f8Vendor Advisory

Published

Oct 6, 2026

Last Modified

Oct 13, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96578The GSpeech TTS – WordPress Text To Speech Plugin plugin for…7.2
• CVE-2026-9658Plack::Middleware::Security::Common versions before 0.13.1 f…7.3
• CVE-2026-96580Gitea expanded a workflow's static `strategy.matrix` into it…7.5
• CVE-2026-96581Authorization Bypass Through User-Controlled Key vulnerabili…7.6
• CVE-2026-96582A HID report descriptor is a sequence of items, each declari…4.9
• CVE-2026-96587The Viidure Android application embeds permanent, plaintext …10
• CVE-2026-9659Multiple exploitable stack-based buffer overflow vulnerabili…9.1
• CVE-2026-96594The Gitea API endpoint `GET /api/v1/repos/{owner}/{repo}/med…6.1
• CVE-2026-96596Loop with Unreachable Exit Condition ('Infinite Loop') vulne…5.9
• CVE-2026-96599Isotope eCommerce through 2.9.10 derives order identifiers f…5.9
• CVE-2026-9660Multiple exploitable stack-based buffer overflow vulnerabili…9.1
• CVE-2026-96600Isotope eCommerce through 2.9.10 contains a blind SQL inject…5.5