CVE-2026-118386: fallo de gravedad media en Gitea
Gitea Actions fork workflow trust through pull request review commit
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 6.5epss 0.1%
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a `GITEA_TOKEN` with write access to the repository. Review-triggered workflows now run on the pull request head.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Productos afectados
Gitea · GiteaCVEs relacionadas — Gitea
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-60004CRITICALCVE-2026-60004EPSS 24.0%KEVCVE-2026-59774CRITICALGitea Org-mode file disclosure and code executionEPSS 28.3%CVE-2019-1010314—CVE-2019-1010314EPSS 0.8%CVE-2019-1010261—CVE-2019-1010261EPSS 0.8%CVE-2026-94205CRITICALGitea fork workflow approval bypass through maintainer-triggered eventsEPSS 0.6%CVE-2026-96404HIGHGitea installer authentication bypass for existing accountsEPSS 0.6%