CVE-2026-118386 Gitea CVE debrief

Who should care

Gitea instance administrators and users with read access to repositories should assess their exposure and take necessary actions to prevent exploitation. This includes verifying instance updates, restricting write access, and monitoring workflow activity. Security teams and vulnerability management teams should also review the vulnerability and its potential impact on their systems.

Why it matters

CVE-2026-118386 allows attackers to bypass approval for workflow runs, potentially leading to unauthorized access to sensitive information and elevated privileges within Gitea repositories.

• Potential unauthorized access to Actions secrets
• Possible elevation of privileges through GITEA_TOKEN
• Risk of malicious workflow execution without approval
• Need for verification of instance updates and monitoring of workflow activity

Technical summary

The vulnerability arises from a discrepancy in how commits are checked for workflow triggers and fork restrictions in Gitea. An attacker can exploit this by submitting a crafted pull request review that names a malicious commit, potentially gaining access to Actions secrets and repository tokens if a runner is serving the repository. This issue allows attackers to bypass approval for workflow runs, potentially leading to unauthorized access to sensitive information and elevated privileges within Gitea repositories.

Defensive priority

Defenders should prioritize verifying their Gitea instances are updated to a version that fixes this vulnerability, restrict write access to repositories, and closely monitor workflow runs for suspicious activity.

Recommended defensive actions

• Verify Gitea instances are updated to the latest version
• Restrict write access to repositories
• Monitor workflow runs for suspicious activity
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and references to patches and advisories. Evidence is limited to public sources and may not be comprehensive. Defenders should verify instance updates and review workflow activity for potential exposure. Additional details can be found in the official CVE Program record and NIST NVD detail page.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.