CVE-2026-118386 Details
Description
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a `GITEA_TOKEN` with write access to the repository. Review-triggered workflows now run on the pull request head.
A vulnerability in Gitea's Actions workflow management allows users with read access to a repository to execute their own workflows on the repository's Actions runner. This is achieved by submitting a pull request review that references a commit the user has control over. The workflow is then executed without the usual approval process, granting access to the repository's Actions secrets and a token that can write to the repository. The issue arises because the workflow is read from the commit specified in the review, rather than from the pull request itself, creating a loophole that can be exploited by users with only read permissions.
Users can upgrade to Gitea version 28.3.0, where this vulnerability has been fixed. Instructions for downloading the latest version are available on the Gitea releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/40099 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/40117 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-32h8-5xqg-h466 | Gitea Limited | AdvisoryRemedyTechnical AnalysisVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| gitea.dev | >= 1.19.0, <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |