CVE-2026-116289 Gitea CVE debrief

Who should care

Gitea instance administrators and users with `write:organization` permissions should assess exposure and verify restrictions on personal access tokens to prevent unauthorized access to private repositories.

Why it matters

CVE-2026-116289 allows an attacker to bypass personal access token restrictions, potentially leading to unauthorized access to private repository content and sensitive information. Gitea instance administrators and users with `write:organization` permissions should verify token restrictions and assess exposure to prevent compromise.

• Potential unauthorized access to private repository workflow content
• Possible exposure of Actions secrets and variables
• Risk of task token compromise with access to private repositories
• Need for verification of Gitea instance vulnerability and token restrictions

Technical summary

Gitea did not reject personal access tokens restricted to public resources on the organization Actions runner registration-token endpoint. An attacker with a `public-only` token and `write:organization` permissions could register an organization-level runner and access private repositories' workflow content, Actions secrets and variables, and task tokens. This issue allows an attacker to bypass personal access token restrictions, potentially leading to unauthorized access to private repository content and sensitive information. Gitea instance administrators and users with `write:organization` permissions should verify token restrictions and assess exposure to prevent compromise.

Defensive priority

Defenders should prioritize verifying Gitea instances and restricting personal access tokens to prevent unauthorized access to private repositories.

Recommended defensive actions

• Verify Gitea instances for vulnerability to CVE-2026-116289
• Restrict personal access tokens to prevent unauthorized access to private repositories
• Monitor Gitea instance logs for suspicious activity related to Actions runner registration
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE Program and NIST NVD records provide details on the vulnerability, but additional information from Gitea's official sources may be necessary to fully understand the issue. Gitea instance administrators should verify token restrictions and assess exposure to prevent unauthorized access to private repositories. Evidence limits suggest that further details may be available through vendor advisories or source code review, but specific claims require defensive verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.