https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:49:30 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-333339 EUVD-2026-333339 https://cve.radiocsirt.org/vuln/euvd-2026-333339 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58424 <p>Permanent Fork PR Workflow Approval Gate Bypass</p> <p>Permanent Fork PR Workflow Approval Gate Bypass</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-58424 https://cve.radiocsirt.org/vuln/ghsa-777r-4v59-6486 <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>| Field | Value | |-------|-------| | **Identifier (researcher-assigned)** | GITEA-2026-004 | | **Product** | Gitea (self-hosted Git service) | | **Component** | Gitea Actions — fork pull request approval gate | | **Affected versions** | All Gitea releases **`v1.20.0` and later**, including the latest `main` (`1.27.0+dev-289-gb7e95cc48c`). The buggy logic was introduced in commit `edf98a2dc3` — *&#34;Require approval to run actions for fork pull request (#22803)&#34;*, 2023-02-24 — and has shipped unchanged since. | | **Fixed in** | not yet (this disclosure) | | **Authentication required** | Yes — one unprivileged Gitea account capable of forking the target repository (the default ability for every authenticated user) | | **User interaction required** | Exactly **once** — a repository administrator must approve a single benign fork PR&#39;s workflow run from the attacker. After that, *no further interaction is ever required* for any future fork PR from the same attacker on the same repository. | | **Discovered by** | Prakhar Porwal — `prakharporwal2004@gmail.com` | | **Live-verified on** | Gitea `main` at commit `b7e95cc48cc0e0d6fe24c89bb83da5b84a74490f`, 2026-05-24 |</p> <p>---</p> <p>## 1. Executive summary</p> <p>Gitea Actions enforces an approval gate on workflow runs triggered by fork pull requests, so that an untrusted contributor cannot execute arbitrary workflow YAML on the maintainer&#39;s runner infrastructure without explicit consent. The gate is implemented by `ifNeedApproval()` in `services/acti…</p> <p><strong>Affected:</strong> Go: code.gitea.io/gitea</p> <p>| Field | Value | |-------|-------| | **Identifier (researcher-assigned)** | GITEA-2026-004 | | **Product** | Gitea (self-hosted Git service) | | **Component** | Gitea Actions — fork pull request approval gate | | **Affected versions** | All Gitea releases **`v1.20.0` and later**, including the latest `main` (`1.27.0+dev-289-gb7e95cc48c`). The buggy logic was introduced in commit `edf98a2dc3` — *&#34;Require approval to run actions for fork pull request (#22803)&#34;*, 2023-02-24 — and has shipped unchanged since. | | **Fixed in** | not yet (this disclosure) | | **Authentication required** | Yes — one unprivileged Gitea account capable of forking the target repository (the default ability for every authenticated user) | | **User interaction required** | Exactly **once** — a repository administrator must approve a single benign fork PR&#39;s workflow run from the attacker. After that, *no further interaction is ever required* for any future fork PR from the same attacker on the same repository. | | **Discovered by** | Prakhar Porwal — `prakharporwal2004@gmail.com` | | **Live-verified on** | Gitea `main` at commit `b7e95cc48cc0e0d6fe24c89bb83da5b84a74490f`, 2026-05-24 |</p> <p>---</p> <p>## 1. Executive summary</p> <p>Gitea Actions enforces an approval gate on workflow runs triggered by fork pull requests, so that an untrusted contributor cannot execute arbitrary workflow YAML on the maintainer&#39;s runner infrastructure without explicit consent. The gate is implemented by `ifNeedApproval()` in `services/acti…</p> https://cve.radiocsirt.org/vuln/ghsa-777r-4v59-6486 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149 <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> <p>Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, vertrauliche Informationen offenzulegen oder einen Denial-of-Service-Zustand zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2149