CVE-2026-103670

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with `cancel-in-progress` enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-103670

EUVD

EUVD-2026-93911

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

This vulnerability involves Gitea Actions where inserting a new run cancels older runs in the same concurrency group without checking if the new run still needs approval. Fork pull request runs can cancel trusted in-progress runs under the base repository if they share a concurrency group with cancel-in-progress enabled, without requiring approval or running any code.

Detection Guidance

This vulnerability involves Gitea Actions run cancellation without proper approval checks. To detect it, inspect Gitea workflow configurations for `concurrency` groups with `cancel-in-progress: true` and verify if fork PR runs can trigger cancellations of trusted runs. Check Gitea server logs for unexpected run cancellations and review workflow YAML files for concurrency settings.

Impact Analysis

This vulnerability could allow an attacker with pull request access from a fork to interrupt deployments or leave partial state behind on self-hosted runners by cancelling in-progress runs that share a concurrency group.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves unauthorized cancellation of workflow runs in Gitea Actions, which could disrupt operations but does not inherently impact data protection or privacy requirements.

Mitigation Strategies

Disable concurrency groups with cancel-in-progress enabled for workflows that handle deployments or sensitive operations. Review workflow configurations to ensure fork pull request runs cannot interfere with trusted repository runs.

Hi! I’m here to help you understand CVE-2026-103670. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70