CVE-2026-66877
8.1HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-284
Impact
Authenticated attackers can run unapproved workflow code on self-hosted runners by triggering concurrency cancellations. They only need low-privilege access to submit a pull request from a fork.
Root cause
Job transition and dispatch paths fail to re-check contributor approval requirements when sibling jobs in a shared concurrency group are re-emitted after cancellation.
Affected systems
Gitea versions prior to 1.27.3
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade Gitea to version 1.27.3 or later. If patching immediately is not possible, temporarily disable Gitea Actions or disconnect self-hosted runners.
$ gitea --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.