CVE-2026-73126 Gitea CVE debrief

Who should care

Gitea administrators and users with private repositories should assess their exposure to this vulnerability and take steps to remediate it, as it could lead to unauthorized disclosure of private workflow status.

Why it matters

Defenders should prioritize verifying and remediating this vulnerability in Gitea instances, especially those with private repositories, to prevent unauthorized disclosure of workflow status. This requires Gitea administrators and users to assess their exposure and apply patches or updates provided by Gitea.

• Potential unauthorized disclosure of private workflow status
• Bypass of repository-read scope and public-only restrictions on tokens
• Increased risk of sensitive information exposure in private repositories

Technical summary

The Gitea Actions workflow status badge endpoint does not properly enforce repository-read scope or public-only restrictions on authenticating tokens. This vulnerability allows tokens without read:repository or restricted to public repositories to access the latest workflow status of private repositories owned by the token holder, thereby disclosing private workflow status beyond the intended permissions of the token.

Defensive priority

Defenders should prioritize verifying and remediating this vulnerability in Gitea instances, especially those with private repositories, to prevent unauthorized disclosure of workflow status.

Recommended defensive actions

• Verify Gitea instances for vulnerability and assess exposure of private repositories
• Restrict repository access and token scopes to prevent unauthorized workflow status disclosure
• Apply patches or updates provided by Gitea to fix the vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. To verify and remediate this vulnerability, defenders should assess Gitea instances, especially those with private repositories, and apply patches or updates provided by Gitea. The vulnerability allows tokens lacking read:repository or restricted to public repositories to retrieve the latest workflow status of a private repository accessible to its owner, disclos[述

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.