update changelog

Signed-off-by: E99p1ant <i@github.red>

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to Gogs are documented in this file.
 
 ## 0.15.0+dev (`main`)
 
+### Fixed
+
+- _Security:_ Repository collaborators with Admin access could escalate their own or others' access mode to Owner via the web UI.
+
 ### Removed
 
 - The `gogs cert` subcommand. [#8153](https://github.com/gogs/gogs/pull/8153)

internal/database/repo_collaboration.go

@@ -125,8 +125,8 @@ func (r *Repository) GetCollaborators() ([]*Collaborator, error) {
 
 // ChangeCollaborationAccessMode sets new access mode for the collaboration.
 func (r *Repository) ChangeCollaborationAccessMode(userID int64, mode AccessMode) error {
-	// Discard invalid input
-	if mode <= AccessModeNone || mode > AccessModeOwner {
+	// Collaborators can hold at most Admin access; Owner is reserved for the repository owner.
+	if mode <= AccessModeNone || mode > AccessModeAdmin {
 		return nil
 	}