The vulnerability identified as CVE-2026-58433 in Gitea involves a bypass of the RepoAdminChangeTeamAccess organization setting via the team-repository linking endpoint. This bypass allows an attacker to change team access permissions on repositories without proper authorization. The issue is classified under CWE-862 (Missing Authorization), indicating that the system fails to enforce correct access control checks. The CVSS 3.1 base score is 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality and integrity.

Successful exploitation can lead to unauthorized modification of team access permissions on repositories, compromising confidentiality and integrity of repository data. This could allow attackers to gain unauthorized access to sensitive code or information within the affected Gitea instance. There is no indication of impact on availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is provided in the available data, organizations using Gitea should monitor vendor communications for updates. Until a patch is available, restrict network access to the Gitea server and review team access permissions carefully to detect any unauthorized changes.