Vulnerability · Published Oct 14, 2026 · Assigned by Gitea

CVE-2026-71184Gitea fork workflow approval bypass through review events

High 8.8

In plain English

A high-severity incorrect authorization in Gitea from Gitea. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities).

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)0.5%top 57.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea	1.20.0 – through 1.27.1

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory GHSA-7w2r-xwp6-mh6c vendor-advisory
Gitea 1.27.3 release announcement release-notes
Fix: go-gitea/gitea pull request #39005 patch
Fix: go-gitea/gitea pull request #39018 patch
go-gitea/gitea v1.27.3 release release-notes