CVE-2026-71184

Deferred Deferred - Pending Action

Gitea Pull Request Review Workflow Code Execution

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: Gitea Limited

Description

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-71184

EUVD

EUVD-2026-101098

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.20.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea allows attackers to bypass pull request approval requirements for fork repositories. When a review comment is submitted on a pull request, the system fails to attach the pull request to the Actions notification. This causes the workflow approval gate to ignore the fork origin, allowing unapproved workflow code from the fork to execute on the base repository's runners without maintainer approval.

Detection Guidance

To detect this vulnerability, check if your Gitea instance is running a vulnerable version (1.20.0 through 1.27.2). Run 'gitea --version' to verify the version. Inspect Actions workflow logs for fork pull requests that bypass approval checks, particularly those triggered by review comments or approvals without proper pull request context.

Impact Analysis

An attacker could exploit this to run unauthorized workflow code on your repository's runners. This may lead to unauthorized access to secrets, execution of malicious code, or misuse of compute resources. The impact depends on the runner configuration and permissions in your Gitea instance.

Compliance Impact

This vulnerability could lead to unauthorized code execution or access to sensitive data, potentially violating compliance requirements for data protection and security. Organizations using Gitea Actions may face increased risk of data breaches or unauthorized access, which could result in non-compliance with standards like GDPR or HIPAA.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later to patch the vulnerability. Review and monitor pull request review comments and approval events for unauthorized workflow executions.

Hi! I’m here to help you understand CVE-2026-71184. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70