Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-112887— Gitea Actions task token private repository enumeration

Quick assessment

Affected

Gitea Gitea

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Gitea Actions 任务令牌以 ID 为负数的共享系统用户身份向 REST API 进行身份验证。在此机制下，仓库、组织、项目和密钥等过滤器被视作未施加所有者限制，且该令牌未携带任何 API 作用域（scope）来限制用户作用域的路由。因此，任何能够运行工作流的用户均可利用该作业令牌，通过接口列出实例上的所有仓库（包括其他用户和组织的私有仓库）及其元数据。不过，仓库内容本身仍受每个仓库独立的权限检查保护。修复后，系统用户不再拥有任何资源，且除以外的路由仅接受个人账户和机器人账户（bot accoun

AI Predicted 6.5 Difficulty: Easy Updated Nov 01, 2026

Possible ATT&CK Techniques 3 AI

T1055 · Process Injection T1087 · Account Discovery T1078 · Valid Accounts

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Gitea	Gitea	`< 28.3.0`	affected

Updated Nov 01, 2026

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Gitea Actions task token private repository enumeration

Source: CVE Program / CVE List V5

Vulnerability Description

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

信息暴露

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Gitea	Gitea	0 ~ 28.3.0	-

II. Public POCs for CVE-2026-112887

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-112887

请登录查看更多情报信息。

Other References for CVE-2026-112887 (5)

https://github.com/go-gitea/gitea/releases/tag/v28.3.0 release-notes
https://blog.gitea.com/release-of-28.3.0/ release-notes
https://github.com/go-gitea/gitea/pull/39945 patch
https://github.com/go-gitea/gitea/security/advisories/GHSA-8r36-6j2c-3gmv vendor-advisory
https://github.com/go-gitea/gitea/pull/40115 patch

https://www.cve.org/CVERecord?id=CVE-2026-112887

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117649		Gitea private issue disclosure through issue dependency timeline events
CVE-2026-118386		Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263		Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-113429		Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199		Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289		Gitea public-only token bypass through Actions runner registration
CVE-2026-116296		Gitea archived repository release, milestone and label modification
CVE-2026-116474		Gitea Actions job token spoofing of instance-signed commits
CVE-2026-117635		Gitea admin API public-only token scope bypass
CVE-2026-117646		Gitea private repository listing to public-only tokens on profiles
CVE-2026-119627		Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117677		Gitea Helm chart upload decompression denial of service
CVE-2026-117685		Gitea public-only package token access to private OCI blobs
CVE-2026-118394		Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395		Gitea public-only token bypass in repository and organization creation
CVE-2026-118504		Gitea issue changes on archived repositories through the API
CVE-2026-119441		Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533		Gitea private pull request disclosure on project boards
CVE-2026-119625		Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea

Same vendor: Gitea

Same weakness: CWE-200