CVE-2026-73126

Deferred Deferred - Pending Action

Gitea Actions Workflow Status Badge Information Disclosure

Publication date: 2026-10-14

Last updated on: 2026-10-14

Assigner: Gitea Limited

Description

Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73126

EUVD

EUVD-2026-101100

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in Gitea's Actions workflow status badge endpoint allows tokens with limited permissions to access private repository workflow status. Normally, tokens must have read:repository scope or be restricted to public repositories to access such data. However, the badge endpoint bypasses these checks, enabling unauthorized monitoring of private CI activity.

Detection Guidance

Check Gitea server logs for unauthorized access attempts to workflow badge endpoints. Monitor network traffic for requests to /api/v1/repos/{owner}/{repo}/actions/badge.svg with tokens lacking repository-read scope. Use curl to test endpoints: curl -H 'Authorization: token <TOKEN>' https://<GITEA_SERVER>/api/v1/repos/{owner}/{repo}/actions/badge.svg. If the endpoint returns workflow status for private repos with restricted tokens, the vulnerability is present.

Verify Gitea version. If running 1.27.2 or earlier, the system is vulnerable. Upgrade to 1.27.3 or later to patch the issue.

Impact Analysis

An attacker with a restricted token could check the status of private workflows without modifying content or accessing files. This exposes sensitive CI activity, potentially revealing project timelines, build failures, or other operational details to unauthorized parties.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by exposing private CI workflow status information without proper authorization. Unauthorized access to private repository workflow status may lead to unintended disclosure of sensitive operational data, which could violate data protection requirements under these regulations.

Mitigation Strategies

Upgrade Gitea to version 1.27.3 or later immediately to address the token scope enforcement bypass. There are no workarounds; patching is required. Review and revoke any tokens that may have been exposed or used to access private workflow badges.

Hi! I’m here to help you understand CVE-2026-73126. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70