CVE-2026-66877— Gitea fork workflow approval bypass through concurrency cancellation
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gitea 通过阻止作业执行来要求首次贡献者（fork 贡献者）的变更在合并前必须经过审批，但某些作业状态转换和任务分发的路径并未重新检查运行作业的审批要求。一个共享作业级并发组的独立运行作业可以取消待处理的作业，导致其被阻止的相邻作业未经重新审批而被重新发出并分发执行。这允许未经审核的工作流代码在自托管运行器上执行；不过，fork 仓库的密钥依然不会被泄露，运行令牌也保持只读权限。
Possible ATT&CK Techniques 1 AI
T1534 · Internal Spearphishing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-66877
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea fork workflow approval bypass through concurrency cancellation
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-66877
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-66877
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-66877 (2)
Other References for CVE-2026-66877 (2)
Other References for CVE-2026-66877 (1)
-
https://blog.gitea.com/release-of-1.27.3/ release-notes
Same Patch Batch · Gitea · 2026-10-14 · 36 CVEs total
| CVE-2026-68964 | Gitea restricted-user SSH and GPG key metadata disclosure | |
| CVE-2026-70396 | Gitea organization repository creation token scope bypass | |
| CVE-2026-70406 | Gitea private comparison disclosure with public-only tokens | |
| CVE-2026-70400 | Gitea private migration creation with public-only tokens | |
| CVE-2026-70402 | Gitea local code execution through writable Git hooks | |
| CVE-2026-67577 | Gitea restricted-user activity and heatmap disclosure | |
| CVE-2026-63792 | Gitea private reusable workflow disclosure to fork runs | |
| CVE-2026-63021 | Gitea Swift package manifest memory exhaustion | |
| CVE-2026-62925 | Gitea Alpine package parsing memory exhaustion | |
| CVE-2026-70407 | Gitea organization listing token scope bypass | |
| CVE-2026-68957 | Gitea restricted-user issue search disclosure | |
| CVE-2026-73814 | Gitea repository ownership escalation by administrators | |
| CVE-2026-73800 | Gitea reusable workflow secret exposure in pull_request_target | |
| CVE-2026-73535 | Gitea second-factor bypass through OpenID identity linking | |
| CVE-2026-73804 | Gitea API token scope escalation through HTTP signatures | |
| CVE-2026-73539 | Gitea external renderer argument injection and code execution | |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | |
| CVE-2026-78433 | Gitea private attachment disclosure through repository mismatch | |
| CVE-2026-73130 | Gitea repository initialization resource exhaustion | |
| CVE-2026-73802 | Gitea Runner host isolation bypass through container options |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73800
Gitea reusable workflow secret exposure in pull_request_targ
Same vendor: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73802
Gitea Runner host isolation bypass through container options
V. Comments for CVE-2026-66877
No comments yet