The vulnerability allows a repository administrator who is not an organization owner to link organization teams to a repository even when the global setting RepoAdminChangeTeamAccess is disabled. This bypass removes the access restriction so the attacker can grant unintended teams access to repository contents, potentially exposing code and related assets. The flaw is an authorization bypass, mapped to CWE-266 and CWE-863, and results in privilege escalation within the same organization.

Affected product is Gitea. No version information is provided, so all deployments using Gitea may be vulnerable if the global setting RepoAdminChangeTeamAccess is set to false and repository administrators exist.

The CVSS score of 6.5 indicates a medium severity. The EPSS score is < 1% and the vulnerability is not listed in CISA KEV. The attack path requires the attacker to have repository admin privileges within an organization that is missing the owner permission. Once privileged, the attacker can trigger the API endpoint without permission checks, elevating control of team access. Because of the lack of public exploitation data, the risk is primarily determined by the medium CVSS and the potential for internal abuse.