Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-104626— Gitea fork workflow job revival through later approval

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

能够发起从分支拉取请求（fork pull request）的用户，可以将包含共享运行级别并发组的 workflow 内容放入一个等待审批的 Gitea Actions 运行任务中。当该并发组中的后续运行任务取消被阻塞的作业时，该运行任务虽然仍处于“需要审批”状态，但其状态已变为终止（terminal）。如果维护者随后批准了该运行任务，Gitea 会将已取消的作业重新通过并发准备阶段，将其状态设置为等待，并使其可被匹配的 runner 领取，从而执行由 fork 控制的 workflow 代码。 利用此漏洞需满足以

AI Predicted 7.5 Difficulty: Moderate

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea ≤ 1.27.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-104626

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea fork workflow job revival through later approval
Source: CVE Program / CVE List V5
Vulnerability Description
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
行为工作流的不恰当实施
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 0 ~ 1.27.3 -

II. Public POCs for CVE-2026-104626

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-104626

请登录查看更多情报信息。

Other References for CVE-2026-104626 (4)

Same Patch Batch · Gitea · 2026-10-06 · 21 CVEs total

CVE-2026-104636 Gitea SSRF through Git HTTP redirects in mirrors and fetches
CVE-2026-73278 Gitea WebAuthn bypass during OAuth and OIDC sign-in
CVE-2026-79960 Gitea deploy key pushes acting as the repository owner
CVE-2026-70357 Gitea repository migration SSRF through DNS rebinding
CVE-2026-96580 Gitea Actions memory exhaustion through large static matrices
CVE-2026-96589 Gitea private repository access retained after rejected transfer
CVE-2026-96400 Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS
CVE-2026-96399 Gitea denial of service through external issue tracker patterns
CVE-2026-96404 Gitea installer authentication bypass for existing accounts
CVE-2026-104632 Gitea fork workflow approval bypass through cancel and rerun
CVE-2026-94205 Gitea fork workflow approval bypass through maintainer-triggered events
CVE-2026-101027 Gitea migration SSRF through ALLOWED_DOMAINS address check bypass
CVE-2026-101029 Gitea migration and pull mirror SSRF through multi-answer DNS
CVE-2026-95106 Gitea review and execution mismatch through duplicate tree entries
CVE-2026-95112 Gitea issue reference parsing CPU exhaustion
CVE-2026-89430 Gitea push mirror SSRF and forced writes to internal Git hosts
CVE-2026-103504 Gitea API team demotion not applied to unit permissions
CVE-2026-103667 Gitea container registry stored XSS through blob media type
CVE-2026-103059 Gitea built-in SSH server authentication bypass through key case folding
CVE-2026-103670 Gitea trusted workflow cancellation by unapproved fork runs

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-841

V. Comments for CVE-2026-104626

No comments yet

Leave a comment