https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 02:01:38 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-352282 EUVD-2026-352282 https://cve.radiocsirt.org/vuln/euvd-2026-352282 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58416 <p>Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)</p> <p>Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58416 https://cve.radiocsirt.org/vuln/ghsa-fj8v-hjwv-qm88 <p><strong>Affected:</strong> Go: gitea.dev</p> <p>### Summary</p> <p>`GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — **except the collaborative-owner branch**, which is missing the `!task.IsForkPullRequest` guard that its sibling has. As a result, when a private repo **B** lists owner **A** as a collaborative owner, an **attacker-controlled fork pull-request** workflow whose base repo is owned by A is granted code-read on B — i.e. the fork&#39;s YAML can clone a third private repository it has no rights to.</p> <p>### Details</p> <p>```go // models/perm/access/repo_permission.go (v1.26.2), in GetActionsUserRepoPermission if checkSameOwnerCrossRepoAccess(ctx, taskRepo, repo, task.IsForkPullRequest) { // passes isForkPR -&gt; denies forks return maxPerm, nil } ... if taskRepo.IsPrivate { // &lt;-- NO IsForkPullRequest check here actionsUnit := repo.MustGetUnit(ctx, unit.TypeActions) if actionsUnit.ActionsConfig().IsCollaborativeOwner(taskRepo.OwnerID) { return maxPerm, nil // grants code-read to target repo B } } ```</p> <p>The sibling same-owner path correctly denies fork PRs:</p> <p>```go func checkSameOwnerCrossRepoAccess(ctx, taskRepo, targetRepo, isForkPR bool) bool { if isForkPR { return false // Fork PRs are never allowed cross-repo access to other private repositories. } ... } ```</p> <p>`taskRepo` = the repo…</p> <p><strong>Affected:</strong> Go: gitea.dev</p> <p>### Summary</p> <p>`GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — **except the collaborative-owner branch**, which is missing the `!task.IsForkPullRequest` guard that its sibling has. As a result, when a private repo **B** lists owner **A** as a collaborative owner, an **attacker-controlled fork pull-request** workflow whose base repo is owned by A is granted code-read on B — i.e. the fork&#39;s YAML can clone a third private repository it has no rights to.</p> <p>### Details</p> <p>```go // models/perm/access/repo_permission.go (v1.26.2), in GetActionsUserRepoPermission if checkSameOwnerCrossRepoAccess(ctx, taskRepo, repo, task.IsForkPullRequest) { // passes isForkPR -&gt; denies forks return maxPerm, nil } ... if taskRepo.IsPrivate { // &lt;-- NO IsForkPullRequest check here actionsUnit := repo.MustGetUnit(ctx, unit.TypeActions) if actionsUnit.ActionsConfig().IsCollaborativeOwner(taskRepo.OwnerID) { return maxPerm, nil // grants code-read to target repo B } } ```</p> <p>The sibling same-owner path correctly denies fork PRs:</p> <p>```go func checkSameOwnerCrossRepoAccess(ctx, taskRepo, targetRepo, isForkPR bool) bool { if isForkPR { return false // Fork PRs are never allowed cross-repo access to other private repositories. } ... } ```</p> <p>`taskRepo` = the repo…</p> https://cve.radiocsirt.org/vuln/ghsa-fj8v-hjwv-qm88 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304 <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um beliebigen Programmcode auszuführen, erweiterte Berechtigungen zu erlangen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, sensible Informationen offenzulegen, Sitzungen zu übernehmen oder wiederzuverwenden oder einen Denial-of-Service-Zustand auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2304