EUVD-2026-41607
GHSA-777r-4v59-6486
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
Network-reachable fork PR needs a low-priv contributor (PR:L) and a maintainer approval action (UI:R); bypass lets untrusted workflow code hit CI runners/secrets (S:C, I:H/A:H, C:L).
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:H
Lifecycle Timeline
1DescriptionCVE.org
Permanent Fork PR Workflow Approval Gate Bypass
AnalysisAI
Authorization bypass in Gitea's Gitea Actions fork pull-request approval gate lets a low-privileged contributor permanently defeat the maintainer approval step that normally guards workflow execution on fork PRs, so that after the initial gate is subverted the attacker's workflow code runs against the repository's CI runners and secrets. CVSS is 8.9 (high) with a scope change and high integrity/availability impact; no public exploit has been identified at time of analysis, but a vendor patch (v1.26.4) is available. The flaw is classed as CWE-285 (Improper Authorization) and was self-reported by the Gitea project.
Technical ContextAI
Gitea is a self-hosted, lightweight open-source Git service (CPE cpe:2.3:a:gitea:gitea_open_source_git_server) that bundles Gitea Actions, a GitHub-Actions-compatible CI/CD engine. To prevent untrusted contributors from running arbitrary CI code, Gitea gates workflows triggered by fork pull requests behind an explicit maintainer approval - first-time or untrusted authors must have their runs approved before workflows execute. The root cause is CWE-285 (Improper Authorization): the logic that enforces this approval gate can be bypassed such that approval becomes 'permanent,' meaning the trust decision is applied too broadly or persisted incorrectly, allowing subsequent (or modified) fork PR workflow runs to execute without re-approval. Because workflow runners typically have access to repository tokens, secrets, and build infrastructure, an authorization gap here translates directly into unauthorized code execution within the CI context.
RemediationAI
Vendor-released patch: v1.26.4 - upgrade Gitea to 1.26.4 or later, per the advisory GHSA-777r-4v59-6486 (https://github.com/go-gitea/gitea/security/advisories/GHSA-777r-4v59-6486) and release notes at https://github.com/go-gitea/gitea/releases/tag/v1.26.4 and https://blog.gitea.com/release-of-1.26.3-and-1.26.4/; the code fix is in PR https://github.com/go-gitea/gitea/pull/38010. If immediate patching is not possible, reduce exposure by disabling Gitea Actions on sensitive repositories or globally until upgraded (trade-off: halts all CI/CD), or by restricting who can open fork pull requests and tightening the runner trust model - for example limiting Actions to internal collaborators only and not auto-approving fork PR workflows (trade-off: external contributions can no longer run CI). Additionally, scope down and rotate any secrets exposed to Actions runners and audit recent fork PR workflow runs for unexpected approvals, since a bypass may already have granted persistent execution.
More in Gitea Open Source Git Server
View allBroken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Branch-protection bypass in Gitea's self-hosted Git server (all versions before 1.26.0) allows a user with push access t
Migration transport protections in Gitea are bypassed for Git LFS operations, affecting all self-hosted instances before
Authorization bypass in Gitea Open Source Git Server (versions up to and including 1.26.1) allows a user whose account w
Server-side request forgery in Gitea versions up to and including 1.26.2 lets authenticated users abuse incomplete allow
Cross-repository information disclosure and cross-task tampering in Gitea's self-hosted Git server (fixed in v1.26.2) ar
Arbitrary file read and write in Gitea before 1.25.5 arises when the template repository generation feature resolves pat
Improper input validation in Gitea Open Source Git Server before 1.25.5 lets authenticated users submit repository-creat
Authentication bypass via OAuth2 authorization code replay in Gitea before 1.25.5, where the server fails to consistentl
OAuth2 PKCE protection bypass in Gitea before 1.25.5 allows remote attackers to complete an authorization-code token exc
Broken access control in Gitea (self-hosted Git service) versions up to and including 1.26.4 lets the team-repository li
Same weakness CWE-285 – Improper Authorization
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: Important| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today