CVE-2026-71184
Gitea fork workflow approval bypass through review events
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.
| CWE | CWE-863 |
| Vendor | gitea |
| Product | gitea |
| Published | Oct 14, 2026 |
| Last Updated | Oct 14, 2026 |
Stay Ahead of the Next One
Get instant alerts for gitea gitea
Be the first to know when new high vulnerabilities affecting gitea gitea are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gitea / Gitea
1.20.0 ≤ 1.27.1
References
github.com: https://github.com/go-gitea/gitea/security/advisories/GHSA-7w2r-xwp6-mh6c blog.gitea.com: https://blog.gitea.com/release-of-1.27.3/ github.com: https://github.com/go-gitea/gitea/pull/39005 github.com: https://github.com/go-gitea/gitea/pull/39018 github.com: https://github.com/go-gitea/gitea/releases/tag/v1.27.3
Credits
🔍 https://github.com/echoesofwhoami https://github.com/iabdullah215 https://github.com/bircni