CVE-2026-118386
Deferred Deferred - Pending Action

Gitea Workflow Execution via Unauthorized Commit Review

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a `GITEA_TOKEN` with write access to the repository. Review-triggered workflows now run on the pull request head.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-118386

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 1.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Gitea allows a user with read access to a repository to execute malicious workflows on the repository's Actions runner. The attacker submits a pull request review with a commit ID pointing to their own commit, which causes the workflow to run using the repository's secrets and a write token without approval. The issue arises because workflows are read from the reviewer-supplied commit ID while trust decisions are based on the reviewed pull request.

Detection Guidance

Check Gitea server logs for unexpected workflow executions triggered by pull request reviews. Look for workflows running on commits not part of the pull request head branch. Verify if Actions secrets were accessed by unauthorized workflows.

Impact Analysis

An attacker could access repository secrets, including owner secrets, and commit changes to the main branch. This could lead to unauthorized code execution, data breaches, or further compromise of the repository or its owner's resources.

Compliance Impact

This vulnerability allows unauthorized execution of workflows with access to repository secrets and write tokens, potentially leading to data breaches or unauthorized modifications. For GDPR, this could result in unauthorized access to personal data, violating principles of data protection and user consent. Under HIPAA, it may expose protected health information to unauthorized parties, compromising confidentiality and integrity requirements.

Mitigation Strategies

Upgrade Gitea to a version beyond 28.2.0 where the fix is applied. Review and audit recent workflow executions for suspicious activity. Restrict Actions secrets access and monitor for unauthorized token usage.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118386. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...