Log in Start free

Vulnerability · Published Nov 1, 2026 · Assigned by Gitea

CVE-2026-116289Gitea public-only token bypass through Actions runner registration

Unrated

In plain English

A incorrect authorization in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities).

Severity (CVSS )–Not rated
Exploit odds (30 days)0.1%top 95.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with `write:organization` that belongs to an owner of a public organization, an attacker could register an organization-level runner and receive jobs of the organization's private repositories that have Actions enabled, including the workflow content, Actions secrets and variables, and a task token with access to the private repository. The issue widens what the restricted token can reach; it gives nothing beyond what the owner's full account can already do.

Affected products (as reported)

VendorProductVersions
Gitea Gitea 0 – before 28.3.0

Weakness: CWE-863

References