CVE-2026-66874

Deferred Deferred - Pending Action

Gitea Workflow Skipped Status Security Bypass

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-66874

EUVD

EUVD-2026-101088

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-807	The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CWE-345	The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows a fork pull request author to bypass required workflow status checks by creating a workflow that never executes due to branch or path filters. Gitea posts a synthetic skipped status for the required check, which counts as successful. This makes it appear that mandatory workflows have passed, allowing unauthorized code to reach protected branches without actual execution or approval.

Detection Guidance

Check Gitea server logs for skipped workflow statuses on fork pull requests. Look for workflows with branch or path filters that never match the PR head. Verify if required status checks show skipped instead of pending or success. Inspect workflow definitions in fork repositories for deliberately non-matching filters.

Impact Analysis

An attacker with fork access can merge unauthorized code into protected branches without triggering mandatory workflow checks. This bypasses security controls like branch protection or required workflows, potentially allowing malicious code to enter the codebase without detection or proper validation.

Compliance Impact

This vulnerability could undermine compliance with standards requiring mandatory workflow execution for code integrity, such as those in GDPR or HIPAA for audit trails. By allowing skipped statuses to satisfy required checks, unauthorized code might bypass security controls without detection, potentially violating integrity and access control requirements.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later to apply the security fixes. Review and update branch protection rules to require non-skipped status checks. Disable workflow execution from fork pull requests unless absolutely necessary. Audit existing workflows for non-matching filters that could generate skipped statuses.

Hi! I’m here to help you understand CVE-2026-66874. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70