CVE-2026-24059 Gitea CVE debrief

Who should care

Administrators and users of Gitea instances should be aware of this vulnerability and take steps to mitigate it. Affected operator, platform, vulnerability-management, and security-team impact should be reviewed to ensure proper mitigation and exposure review.

Technical summary

The GET /api/v1/user/actions/runners/registration-token endpoint creates a new runner registration token if none exists, but is classified as read-only due to being a GET request. This allows a holder of a leaked read:user-scoped token to mint a registration token and register a malicious Actions runner with access to repository secrets and source code. The vulnerability affects Gitea instances, and defenders should verify if their deployments are affected and review vendor guidance for mitigation. Limited detail is available on affected scope and potential impact.

Defensive priority

Medium-priority defensive actions are required to address the vulnerability. Review and apply patches or mitigations provided by the vendor.

Recommended defensive actions

• Review and apply patches or mitigations provided by the vendor.
• Restrict access to the affected endpoint.
• Monitor for suspicious activity related to runner registration tokens.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

Evidence is based on official CVE and NVD records, as well as vendor-provided information. Limited detail is available on affected scope and potential impact. The vulnerability affects Gitea instances, and defenders should verify if their deployments are affected and review vendor guidance for mitigation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.