CVE-2026-112887
Deferred Deferred - Pending Action

Gitea Actions Token Privilege Escalation via API Misconfiguration

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-112887

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves Gitea Actions task tokens authenticating to the REST API as a shared system user with a negative ID. These tokens bypassed owner restrictions in filters, allowing unauthorized access to private repository metadata via endpoints like GET /api/v1/user/repos. The issue occurred because system users were incorrectly treated as having no owner filter, enabling enumeration of all repositories on an instance, including private ones.

Detection Guidance

Check Gitea logs for unusual API calls to /api/v1/user/repos or user-scoped routes. Monitor for GET requests from system users (e.g., 'gitea-actions') with negative IDs accessing private repository data. Verify token scopes in API responses to ensure no unauthorized enumeration.

Impact Analysis

If you run workflows on a vulnerable Gitea instance, an attacker could exploit this to list every repository, including private ones, by using the job's task token. This exposes repository metadata and may allow further unauthorized access to scope-gated endpoints. The impact includes confidentiality breaches and broken API scope boundaries.

Compliance Impact

This vulnerability could lead to unauthorized disclosure of private repository data, violating confidentiality requirements under GDPR and HIPAA. Exposure of private repository metadata may constitute a data breach, requiring incident reporting and potential fines depending on jurisdiction.

Mitigation Strategies

Update Gitea to the latest patched version. Disable Actions task tokens if not needed. Restrict API access to authenticated users only. Review and revoke any suspicious tokens or repository access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112887. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...