CVE-2026-63792 Gitea CVE debrief

Who should care

Gitea instance administrators and users with private repositories using collaborative-owner configurations for reusable workflows should assess their exposure and potential impact of workflow file disclosure.

Why it matters

Defenders should care about CVE-2026-63792 because it allows potential disclosure of private workflow files in Gitea instances with collaborative-owner configurations. Gitea instance administrators and users with private repositories should assess their exposure and prioritize verification and remediation efforts.

• Potential disclosure of private workflow files to unauthorized parties.
• Possible unauthorized access to sensitive information in private workflows.
• Need for verification of Gitea instance configurations and exposure.
• Priority for updating Gitea instances to version 1.27.3 or later.

Technical summary

The vulnerability in Gitea's reusable workflow feature allows an approved fork workflow targeting a private repository to read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. This issue arises from the lack of exclusion of fork pull request runs in the collaborative-owner authorization path. As a result, an attacker could potentially access sensitive information in private workflows. Gitea instance administrators and users should assess their exposure and prioritize verification and remediation efforts. The issue can be remediated by updating Gitea instances to version 1.27.3 or later and reviewing workflow configurations for 4

Defensive priority

Defenders should prioritize verifying exposure of private reusable workflows in Gitea instances, especially where collaborative-owner configurations are used, and assess the impact of potential workflow file disclosure.

Recommended defensive actions

• Verify Gitea instance configurations for collaborative-owner authorization and reusable workflows.
• Assess exposure of private workflows to fork pull request runs.
• Review and update Gitea instances to version 1.27.3 or later.
• Monitor for potential unauthorized access to private workflow files.
• Perform a detailed review of workflow configurations for potential vulnerabilities.
• Inventory Gitea instances and associated repositories to identify potential exposure.
• Track changes to Gitea instance configurations and monitor for suspicious activity.

Evidence notes

The CVE record and source item provide details on the vulnerability in Gitea's reusable workflow feature, including the potential for private workflow disclosure. However, specific version details and remediation steps are limited.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.