CVE-2026-104632

Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description

Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-07

EPSS Evaluated

2026-10-18

NVD

CVE-2026-104632

EUVD

EUVD-2026-93905

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-285	The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea Actions allows workflow jobs from first-time fork pull request contributors to run on repository runners without required maintainer approval. Normally, jobs are blocked until approved, but cancelling and re-running a stale fork check bypasses this restriction, letting untrusted code execute.

Detection Guidance

This vulnerability involves Gitea Actions improperly handling approvals for fork pull request workflows. To detect it, check Gitea server logs for workflow runs from fork pull requests that bypassed approval checks. Look for canceled and re-run jobs that still executed without proper authorization. No specific commands are provided in the context.

Impact Analysis

If you use Gitea Actions with fork pull requests, attackers could execute malicious workflow code on your runners without approval. This could lead to unauthorized access, data exfiltration, or resource misuse in your environment.

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized code execution, potentially leading to data breaches or unauthorized access. Organizations may fail audits if controls like approval workflows are bypassed.

Mitigation Strategies

Disable Gitea Actions for repositories with fork pull requests or restrict Actions write access to maintainers only until a fix is applied.

Hi! I’m here to help you understand CVE-2026-104632. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70