CVE-2026-73800

Deferred Deferred - Pending Action

Gitea Local Reusable Workflow Code Execution

Publication date: 2026-10-14

Last updated on: 2026-10-18

Assigner: Gitea Limited

Description

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-73800

EUVD

EUVD-2026-101106

Affected Vendors & Products

Vendor	Product	Version / Range
Gitea	Gitea	1.19.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-829	The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-94	The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

Executive Summary

CVE-2026-73800 is a vulnerability in Gitea where the pull_request_target event incorrectly resolves local reusable workflows from a fork's HEAD commit instead of the base branch commit. This allows attacker-controlled workflow code to execute with access to repository and organization secrets when a pull request is opened from a fork.

Detection Guidance

To detect this vulnerability, check Gitea server logs for pull_request_target workflow runs that reference local reusable workflows from fork repositories. Look for workflows using `uses: ./...` in PRs from forks. Verify if the workflow resolution matches the base branch commit or fork head commit.

Impact Analysis

An attacker can modify a referenced reusable workflow in a fork to execute malicious code during a pull_request_target event. This code runs with the repository and organization secrets available to that event, potentially leading to secret exfiltration or unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information security). Unauthorized code execution may result in data breaches or improper handling of regulated data.

Mitigation Strategies

Upgrade Gitea to version 1.27.2 or later to apply the security fix.
Avoid using pull_request_target workflows that call local reusable workflows from forks.
Limit secrets available to fork pull requests as a temporary mitigation.

Hi! I’m here to help you understand CVE-2026-73800. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70