CVE-2026-71184— Gitea fork workflow approval bypass through review events
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Gitea 的拉取请求（Pull Request）评审通知器未将拉取请求附加到 Actions 通知中，因此分支工作流（fork workflow）的审批机制无法识别该运行任务源自于一个分叉仓库（fork）。因此，评审评论、评审批准或拒绝等事件可能会从分叉仓库的 HEAD 加载工作流代码，并在基础仓库（base repository）的运行器上执行，而无需经过预期的维护者审批。这导致分叉仓库控制的工作流代码得以绕过预期的审批边界被执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1652 · Device Driver Discovery
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-71184
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea fork workflow approval bypass through review events
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-71184
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-71184
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-71184 (2)
Other References for CVE-2026-71184 (2)
-
Release v1.27.3 · go-gitea/gitea · GitHub release-notes
Other References for CVE-2026-71184 (1)
-
https://blog.gitea.com/release-of-1.27.3/ release-notes
Same Patch Batch · Gitea · 2026-10-14 · 36 CVEs total
| CVE-2026-68964 | Gitea restricted-user SSH and GPG key metadata disclosure | |
| CVE-2026-70396 | Gitea organization repository creation token scope bypass | |
| CVE-2026-70406 | Gitea private comparison disclosure with public-only tokens | |
| CVE-2026-70400 | Gitea private migration creation with public-only tokens | |
| CVE-2026-70402 | Gitea local code execution through writable Git hooks | |
| CVE-2026-67577 | Gitea restricted-user activity and heatmap disclosure | |
| CVE-2026-63792 | Gitea private reusable workflow disclosure to fork runs | |
| CVE-2026-63021 | Gitea Swift package manifest memory exhaustion | |
| CVE-2026-62925 | Gitea Alpine package parsing memory exhaustion | |
| CVE-2026-70407 | Gitea organization listing token scope bypass | |
| CVE-2026-68957 | Gitea restricted-user issue search disclosure | |
| CVE-2026-73814 | Gitea repository ownership escalation by administrators | |
| CVE-2026-73800 | Gitea reusable workflow secret exposure in pull_request_target | |
| CVE-2026-73535 | Gitea second-factor bypass through OpenID identity linking | |
| CVE-2026-73804 | Gitea API token scope escalation through HTTP signatures | |
| CVE-2026-73539 | Gitea external renderer argument injection and code execution | |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | |
| CVE-2026-78433 | Gitea private attachment disclosure through repository mismatch | |
| CVE-2026-73130 | Gitea repository initialization resource exhaustion | |
| CVE-2026-73802 | Gitea Runner host isolation bypass through container options |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73800
Gitea reusable workflow secret exposure in pull_request_targ
Same vendor: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73802
Gitea Runner host isolation bypass through container options
Same weakness: CWE-863
-
CVE-2026-111446
Wheels 4.0.0-4.1.2 未授权访问漏洞 -
CVE-2026-111369
ClassroomIO through 1.0.0 Incorrect Authorization via Lesson -
CVE-2026-111352
ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST -
CVE-2026-111332
OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Sha -
CVE-2026-45165
Idira Secrets Manager (Self-Hosted): Improper Authorization
V. Comments for CVE-2026-71184
No comments yet