CVE-2026-66877

Deferred Deferred - Pending Action

Gitea Workflow Job Approval Bypass via Concurrency Group

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-66877

EUVD

EUVD-2026-101089

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

CVE-2026-66877 is a vulnerability in Gitea where a legitimate workflow run in a repository can cancel a pending run from a first-time fork contributor. This cancellation triggers a re-evaluation that unblocks and dispatches the fork contributor's jobs without required approval. The bypass allows unreviewed workflow code to execute on self-hosted runners, potentially leading to arbitrary code execution.

Detection Guidance

Check Gitea version with: gitea --version. If version is 1.27.2 or earlier, the system is vulnerable. Inspect GitHub Actions workflows for runs sharing concurrency groups with pending fork PR jobs. Look for unexpected job cancellations or unapproved workflow executions on self-hosted runners.

Impact Analysis

This vulnerability allows attackers to execute arbitrary workflow code on self-hosted runners by bypassing approval requirements. This could grant access to runner hosts, internal network resources, caches, workspaces, and credentials. Fork pull request secrets and run tokens remain protected, but the impact on self-hosted infrastructure could be significant.

Compliance Impact

This vulnerability allows unreviewed workflow code to execute on self-hosted runners, potentially granting access to internal network resources, caches, workspaces, and credentials. This could lead to unauthorized data access or processing, violating GDPR's data protection principles or HIPAA's security requirements for protected health information.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately. Disable fork pull request workflows on self-hosted runners as a temporary workaround. Review and audit all workflows for unauthorized job executions or cancellations.

Hi! I’m here to help you understand CVE-2026-66877. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70