Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.1

Gitea may run unapproved fork code after job cancellation

CVE-2026-66877 · published 21 days ago
Summary

When a user forks a repository in Gitea, the system should require a manager to approve any automation scripts before they run. A cancellation of a related job can skip this approval step, allowing the unapproved script to execute on your own servers. Update Gitea to the latest release that fixes the issue and configure your runners to only accept runs that have been explicitly approved.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
gitea gitea <= 1.27.2
Original advisory text
Gitea fork workflow approval bypass through concurrency cancellation
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
8.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published14 Oct 2026
Updated4 Nov 2026
First seen14 Oct 2026
Sources
CVE-2026-66877 · NVD
CVE-2026-66877 · MITRE
CVE-2026-66877 · OSV
GHSA-v2w8-m4gr-qj65 · GHSA
Track software like this
Free during beta