Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-104626 Details

Description

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.

Metrics

CVSS 3.x Severity and Vector Strings:

No CVSS 3.x data is available for this CVE.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://blog.gitea.com/release-of-28.0.0/	Gitea Limited
https://github.com/go-gitea/gitea/pull/39399	Gitea Limited
https://github.com/go-gitea/gitea/releases/tag/v28.0.0	Gitea Limited
https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2	Gitea Limited

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-841	Improper Enforcement of Behavioral Workflow	Gitea Limited

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes