https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T16:21:55.759458+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-333339 EUVD-2026-333339 2026-10-03T16:21:55.816961+00:00 EUVD-2026-333339 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58424 fkie_cve-2026-58424 2026-10-03T16:21:55.816998+00:00

Permanent Fork PR Workflow Approval Gate Bypass

 https://cve.radiocsirt.org/vuln/ghsa-777r-4v59-6486 GHSA-777r-4v59-6486 — Gitea: Permanent Fork PR Workflow Approval Gate Bypass 2026-10-03T16:21:55.817029+00:00

Affected: Go: code.gitea.io/gitea

| Field | Value | |-------|-------| | **Identifier (researcher-assigned)** | GITEA-2026-004 | | **Product** | Gitea (self-hosted Git service) | | **Component** | Gitea Actions — fork pull request approval gate | | **Affected versions** | All Gitea releases **`v1.20.0` and later**, including the latest `main` (`1.27.0+dev-289-gb7e95cc48c`). The buggy logic was introduced in commit `edf98a2dc3` — *"Require approval to run actions for fork pull request (#22803)"*, 2023-02-24 — and has shipped unchanged since. | | **Fixed in** | not yet (this disclosure) | | **Authentication required** | Yes — one unprivileged Gitea account capable of forking the target repository (the default ability for every authenticated user) | | **User interaction required** | Exactly **once** — a repository administrator must approve a single benign fork PR's workflow run from the attacker. After that, *no further interaction is ever required* for any future fork PR from the same attacker on the same repository. | | **Discovered by** | Prakhar Porwal — `prakharporwal2004@gmail.com` | | **Live-verified on** | Gitea `main` at commit `b7e95cc48cc0e0d6fe24c89bb83da5b84a74490f`, 2026-05-24 |

---

## 1. Executive summary

Gitea Actions enforces an approval gate on workflow runs triggered by fork pull requests, so that an untrusted contributor cannot execute arbitrary workflow YAML on the maintainer's runner infrastructure without explicit consent. The gate is implemented by `ifNeedApproval()` in `services/acti…

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 WID-SEC-W-2026-2149 — Gitea: Mehrere Schwachstellen 2026-10-03T16:21:55.817168+00:00

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.