CVE-2026-71184
8.8HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-863
Impact
Authenticated attackers can run arbitrary workflow code on base repository runners by submitting pull request reviews or comments from a fork. This bypasses the maintainer approval gate required for fork workflows.
Root cause
The pull request review notifier fails to attach pull request metadata to Actions notifications, causing fork workflow runs to bypass fork-approval enforcement.
Affected systems
Gitea versions prior to 1.27.3.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Fix & remediation
Upgrade Gitea to version 1.27.3 or later. If patching immediately is not possible, disable Gitea Actions globally or disable runner execution for repositories accepting untrusted fork pull requests.
$ gitea --versionAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.