CVE-2026-24059
Received Received - Intake

Actions Runner Registration Token Privilege Escalation

Publication date: 2026-08-13

Last updated on: 2026-08-13

Assigner: Gitea Limited

Description
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-13
Last Modified
2026-08-13
Generated
2026-08-13
AI Q&A
2026-08-13
EPSS Evaluated
N/A
NVD
CVE-2026-24059
EUVD
EUVD-2026-58128

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
go-gitea gitea to 1.25.5 (inc)
go-gitea gitea From 1.26.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a security flaw in Gitea's API where a GET request to /api/v1/user/actions/runners/registration-token could create a new runner registration token even though the endpoint was classified as read-only. This allowed attackers with a leaked read-only token to mint registration tokens and register malicious Actions runners that could access repository secrets and source code.

Impact Analysis

If you use Gitea with Actions runners, an attacker could exploit this to register unauthorized runners in your repositories. These runners could then execute workflow jobs with access to sensitive data like repository secrets and source code, leading to data breaches or unauthorized code execution.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Unauthorized access to repository secrets or source code may result in data breaches, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Upgrade Gitea to version 1.26.0 or later to remove the vulnerable GET endpoint for registration tokens. Review API access logs for unauthorized token generation attempts or suspicious runner registrations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-24059. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart