CVE-2026-104626

UNKNOWN 0.0

Gitea fork workflow job revival through later approval

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.

CWE	CWE-841
Vendor	gitea
Product	gitea
Published	Oct 6, 2026

Stay Ahead of the Next One

Get instant alerts for gitea gitea

Be the first to know when new unknown vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Gitea / Gitea

0 ≤ 1.27.3

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2 github.com: https://github.com/go-gitea/gitea/pull/39399 blog.gitea.com: https://blog.gitea.com/release-of-28.0.0/ github.com: https://github.com/go-gitea/gitea/releases/tag/v28.0.0

Credits

https://github.com/opensec-intelligence 🔍 https://github.com/mayank-jangid-moon 🔍 https://github.com/Kushalkhemka 🔍 https://github.com/skigeek16 🔍 https://github.com/nithissh7 🔍 https://github.com/kewmine https://github.com/bircni https://github.com/silverwind