CVE-2026-94205
Undergoing Analysis Undergoing Analysis - In Progress

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-13

Assigner: Gitea Limited

Description
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-13
Generated
2026-10-19
AI Q&A
2026-10-07
EPSS Evaluated
2026-10-18
NVD
CVE-2026-94205
EUVD
EUVD-2026-93919

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
gitea gitea to 28.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
CWE-441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea Actions allows fork-controlled workflow code to run on the base repository's runners without explicit approval. It occurs because the system checks the user who triggered the event instead of the pull request author to determine if approval is needed. This can lead to unauthorized workflow execution from forks.

Detection Guidance

To detect this vulnerability, check Gitea Actions logs for fork pull request workflows triggered by maintainers without explicit approval. Look for workflow runs where the actor is a maintainer but the pull request author is from a fork. Verify if workflows from forks are running on self-hosted runners without proper approval checks.

Impact Analysis

If you use Gitea Actions with fork pull requests, an attacker could submit a malicious workflow in a fork that runs on your repository's runners without your approval. This could allow unauthorized code execution, data exfiltration, or other malicious activities on your infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's data protection requirements or HIPAA's security rules. Organizations may face compliance violations if malicious workflows exfiltrate sensitive data or execute unauthorized actions.

Mitigation Strategies

Disable Gitea Actions for fork pull requests or ensure workflow approvals are based on the pull request author rather than the event triggerer. Review runner configurations to prevent unauthorized workflow execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94205. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart