CVE-2026-112887 Gitea CVE debrief

Who should care

Defenders and administrators of Gitea instances should assess exposure of workflow tokens and restrict access to repository metadata. They should verify configurations, assess exposure, and restrict access to repository metadata to prevent unauthorized listing of private repositories.

Why it matters

CVE-2026-112887 allows listing of repositories on a Gitea instance using a workflow token, but repository contents remain protected. Defenders should verify configurations, assess exposure, and restrict access to repository metadata.

• Repository metadata exposure to unauthorized users
• Potential for unauthorized listing of private repositories
• Need for verification of Gitea instance configurations
• Requirement for restricted access to repository metadata

Technical summary

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, allowing listing of repositories on the instance, including private ones, but not their contents. System users now own nothing, and `/api/v1/user` routes have restricted access. The vulnerability allows an attacker with workflow execution permissions to list all repositories on the Gitea instance, including private ones, using a Gitea Actions task token. This could lead to unauthorized access to repository metadata, potentially allowing attackers to gather information about the instance's repository structure.

Defensive priority

Defenders should verify Gitea instance configurations, assess exposure of workflow tokens, and restrict access to repository metadata.

Recommended defensive actions

• Verify Gitea instance configurations to restrict workflow token access
• Assess exposure of workflow tokens to unauthorized users
• Restrict access to repository metadata
• Monitor for suspicious repository listing activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence from CVE Program and NIST NVD records indicates that Gitea Actions task tokens could be used to list repositories. Repository contents remained protected by per-repository permission checks. The CVE Program and NIST NVD records confirm that Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, allowing listing of repositories on the instance.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.