CVE-2026-73800 Details
Description
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.
A vulnerability in Gitea's handling of reusable workflows in actions can lead to unauthorized access to repository and organization secrets. This issue arises when a pull request is made from a fork and the base workflow calls a local reusable workflow file. Instead of resolving the workflow from the base branch, Gitea incorrectly uses the fork's HEAD commit. As a result, attacker-controlled code can execute with access to sensitive secrets, bypassing intended safeguards. This vulnerability affects Gitea versions 1.19.0 and later, up to 1.27.1.
Users can upgrade to Gitea version 1.27.2, where this vulnerability is fixed. Instructions for upgrading are available in the Gitea documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-1.27.2/ | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/pull/38886 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/pull/38897 | Gitea Limited | Issue TrackingVendor |
| https://github.com/go-gitea/gitea/releases/tag/v1.27.2 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-r9ch-mqjm-g67v | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Gitea Limited |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | >= 1.19.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |