Gitea Actions task token private repository enumeration
Gitea versions before 28.3.0 are affected when Gitea Actions is enabled and at least one runner is registered. A task token can list private repositories across the instance. Fixed in 28.3.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 8/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 28.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Gitea, the self-hosted Git service, is affected through its Actions feature, where workflow job tokens could be used to list metadata for every repository on an instance, including private ones belonging to other users and organizations. The impact is exposure of repository names and metadata to anyone able to run a workflow, though the repository contents themselves stayed protected.
Read the original description
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.
What to do
Check whether your setup matches what the bug needs.
Gitea Actions is enabled and at least one runner is registered The attacker can run a workflow, which yields a task tokenUpgrade to a fixed version: 28.3.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- gitea.dev
fixed in 28.3.0
Evidence 5
- Advisory
- Patch
- Patch
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-112887
What does this mean?
A Gitea Actions task token returns the complete list of repositories on the instance, including every private repository of every user and organization, along with their metadata. Repository contents remain protected. Any account that can run a workflow can obtain such a token.Source: github.com
Am I affected, and how do I check?
Gitea versions before 28.3.0 are affected on instances with Actions enabled, which is the default, and at least one runner registered. The version can be read with the gitea --version command or on the instance's version page, and whether Actions is enabled and whether a runner is registered can be checked in the instance's Actions settings and runner list.Source: github.com
What should I do about it?
Upgrade to Gitea 28.3.0 or later.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data