EUVD-2026-58128
GHSA-m7qq-f4rg-v5m5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
PR:L because a valid read-only token is required; I:H added over vendor score because malicious runner enables arbitrary workflow code execution with integrity impact.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
4DescriptionCVE.org
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
AnalysisAI
Privilege escalation in Gitea Open Source Git Server before 1.25.5 allows an attacker holding a leaked read-only API token to mint a runner registration token and register a malicious Actions runner against the instance. The root cause is that the runner registration-token endpoints - at the user, organization, repository, and admin levels - are classified as read-only by the API scope middleware solely because they use the HTTP GET method, despite creating a token if none exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | A valid Gitea API token with at minimum `read:user` scope (or the org/repo/admin equivalents) is required - the attacker does not need a write-scoped token. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) correctly reflects low-complexity network exploitation with a low-privilege token, but understates integrity impact: registering a malicious runner allows arbitrary code execution within workflow context, which is an integrity impact the vendor's vector omits. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker discovers a Gitea API token with `read:user` scope in a public GitHub repository, a leaked dotfile, or a CI environment variable dump. They issue a single authenticated GET request to `https://gitea.example.com/api/v1/user/actions/runners/registration-token` using that token; the API returns a valid runner registration token. … |
| Remediation | Upgrade to Gitea v1.25.5, which removes all four `GetRegistrationToken` API endpoints entirely rather than reclassifying their scope - the patch at https://github.com/go-gitea/gitea/pull/36801 deletes the handlers from `admin/runners.go`, `user/runners.go`, `org/action.go`, `repo/action.go`, and de-registers the routes in `api.go`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Gitea Open Source Git Server
View allBroken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Authorization bypass in Gitea Open Source Git Server (versions up to and including 1.26.1) allows a user whose account w
Server-side request forgery in Gitea versions up to and including 1.26.2 lets authenticated users abuse incomplete allow
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) ar
Arbitrary file read and write in Gitea before 1.25.5 arises when the template repository generation feature resolves pat
Improper input validation in Gitea Open Source Git Server before 1.25.5 lets authenticated users submit repository-creat
Authentication bypass via OAuth2 authorization code replay in Gitea before 1.25.5, where the server fails to consistentl
OAuth2 PKCE protection bypass in Gitea before 1.25.5 allows remote attackers to complete an authorization-code token exc
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository li
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today