CVE-2026-116289
Deferred Deferred - Pending Action

Gitea Organization Runner Token Privilege Escalation

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with `write:organization` that belongs to an owner of a public organization, an attacker could register an organization-level runner and receive jobs of the organization's private repositories that have Actions enabled, including the workflow content, Actions secrets and variables, and a task token with access to the private repository. The issue widens what the restricted token can reach; it gives nothing beyond what the owner's full account can already do.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-116289

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116289 is a vulnerability in Gitea where a public-only personal access token (PAT) with write:organization permissions could bypass its intended restrictions. An attacker could register an organization-level Actions runner using such a token, allowing the runner to access jobs from private repositories owned by the organization. The runner would then have access to secrets, workflow payloads, and task tokens with push access to private repositories.

Detection Guidance

Check Gitea version with: curl -s https://your-gitea-instance.com/api/v1/version | grep version. If version is below 28.3.0, the system is vulnerable. Review organization runner registrations for unauthorized tokens with write:organization scope. Inspect Actions runner logs for unexpected runner registrations or job assignments.

Impact Analysis

If you are an organization owner with a public-only PAT, an attacker could exploit this to access private repository data, secrets, and workflows. This could lead to unauthorized access, data leaks, or supply chain attacks. The vulnerability requires Actions to be enabled and a public organization with private repositories.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA compliance requirements for data protection and confidentiality. Organizations using Gitea with Actions enabled may face compliance risks due to potential data breaches.

Mitigation Strategies

Upgrade Gitea to version 28.3.0 or later immediately. Review and revoke all public-only tokens with write:organization scope. Audit organization runners for unauthorized registrations. Disable Actions for private repositories if not required. Monitor for suspicious runner activity or job assignments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116289. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...