CVE-2026-71184 Details
Description
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.
A vulnerability in Gitea's pull request review notifier allows for a bypass of the fork workflow approval requirement. This issue is present in Gitea versions 1.20.0 through 1.27.1. The notifier fails to attach the pull request to the Actions notification, causing the fork workflow approval gate to not recognize the run as originating from a fork. As a result, review comment and approval or rejection events can trigger the execution of fork-controlled workflow code on the base repository's runners without the necessary maintainer approval. This exploitation could lead to unauthorized execution of code, particularly on privileged or host runners, with potential access to sensitive secrets, depending on the event rules.
Upgrade to Gitea version 1.27.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.3/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/39005 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/39018 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.3 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-7w2r-xwp6-mh6c | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-863 | Incorrect Authorization | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | >= 1.20.0, <= 1.27.2 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 15, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |