CVE-2026-104626

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104626

EUVD

EUVD-2026-93907

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-841	The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea Actions allows a user with fork pull request access to manipulate workflow execution by exploiting concurrency groups. The attacker places malicious workflow content into a shared run-level concurrency group, causing a blocked job to become terminal while still showing as pending approval. When a maintainer later approves the run, Gitea incorrectly processes the already-cancelled job, allowing the attacker's workflow code to execute on a runner.

Detection Guidance

This vulnerability requires specific conditions to be exploited, including Actions enabled, a shared run-level concurrency group, and a maintainer's approval after a run is cancelled. Detection involves checking Gitea Actions configurations and workflow logs for unusual approvals or job executions after cancellation.

Impact Analysis

If you are a Gitea repository maintainer, this vulnerability could allow unauthorized code execution in your repository's workflows. Attackers could run malicious workflows on your infrastructure, potentially leading to data breaches, unauthorized access, or disruption of services. Users with fork access could escalate privileges or compromise the repository.

Compliance Impact

This vulnerability could lead to unauthorized code execution, potentially violating data protection requirements under GDPR or HIPAA. If malicious workflows access or exfiltrate sensitive data, it may result in compliance breaches, legal penalties, or reputational damage. Organizations must ensure workflow security to maintain regulatory adherence.

Mitigation Strategies

Disable Gitea Actions if not required. If Actions must be enabled, restrict fork pull request workflow execution and review maintainer approval processes to prevent unauthorized job execution.

Hi! I’m here to help you understand CVE-2026-104626. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70