Gitea Actions fork workflow trust through pull request review commit
Gitea versions from 1.19.0 before 28.3.0 are affected when Actions and pull requests are enabled on a repository with a runner. The fix is in Gitea 28.3.0.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 5/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in 28.3.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Gitea, the self-hosted Git service, is affected when its Actions feature runs workflows triggered by pull request reviews. An attacker with only read access to a repository could run their own workflow there, gaining access to that repository's and its owner's Actions secrets and a token with write access to the repository.
Read the original description
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a `GITEA_TOKEN` with write access to the repository. Review-triggered workflows now run on the pull request head.
What to do
Check whether your setup matches what the bug needs.
Actions and pull requests enabled on the repository (default settings) A runner serving the repository One pull request whose head branch is in the same repository (open or merged) An account issued by the operator unless self-registration is enabledUpgrade to a fixed version: 28.3.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- gitea.dev
From 1.19.0 · fixed in 28.3.0
Evidence 5
- Advisory
- Patch
- Patch
- Repository
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-118386
What does this mean?
A pull request whose head branch lives in the same repository can run the attacker's workflow on that repository's runner as a trusted run, without approval. That run can receive the repository's and its owner's Actions secrets and a GITEA_TOKEN that can write to the repository.Source: github.com
Am I affected, and how do I check?
Gitea 1.19.0 up to but not including 28.3.0. It requires Actions and pull requests enabled on the repository (both are defaults), a runner serving that repository, and a same-repository pull request (open or merged). The attacker needs an account, which the operator must issue unless self-registration is enabled. Check your Gitea version and the repository's Actions and pull request settings.Source: github.com
What should I do about it?
Upgrade Gitea to 28.3.0 or later.Source: github.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data