CVE-2026-73800— Gitea reusable workflow secret exposure in pull_request_target
Quick assessment
Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
当针对 事件执行来自受信任分支的工作流时，Gitea 会从 Fork（派生仓库）的 HEAD 提交中解析本地可复用工作流文件。Fork 的维护者可以修改所引用的可复用工作流，从而使攻击者控制的代码在拥有该事件所对应的仓库和组织密钥权限的环境下执行。成功利用此漏洞需要存在一个调用本地可复用工作流的基础工作流，并且该工作流绕过了受信任的基础代码与不可信的 Fork 代码之间的预期隔离机制。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-73800
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gitea reusable workflow secret exposure in pull_request_target
Source: CVE Program / CVE List V5
Vulnerability Description
Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
对生成代码的控制不恰当(代码注入)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-73800
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-73800
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-73800 (2)
Vendor Pages for CVE-2026-73800 (1)
-
🔗 Release v1.27.2 · go-gitea/gitea · GitHub release-notes
Other References for CVE-2026-73800 (1)
Other References for CVE-2026-73800 (1)
-
https://blog.gitea.com/release-of-1.27.2/ release-notes
Same Patch Batch · Gitea · 2026-10-14 · 36 CVEs total
| CVE-2026-62925 | Gitea Alpine package parsing memory exhaustion | |
| CVE-2026-70407 | Gitea organization listing token scope bypass | |
| CVE-2026-70396 | Gitea organization repository creation token scope bypass | |
| CVE-2026-70406 | Gitea private comparison disclosure with public-only tokens | |
| CVE-2026-70400 | Gitea private migration creation with public-only tokens | |
| CVE-2026-70402 | Gitea local code execution through writable Git hooks | |
| CVE-2026-67577 | Gitea restricted-user activity and heatmap disclosure | |
| CVE-2026-63792 | Gitea private reusable workflow disclosure to fork runs | |
| CVE-2026-63021 | Gitea Swift package manifest memory exhaustion | |
| CVE-2026-59774 | Gitea Org-mode file disclosure and code execution | |
| CVE-2026-68964 | Gitea restricted-user SSH and GPG key metadata disclosure | |
| CVE-2026-68957 | Gitea restricted-user issue search disclosure | |
| CVE-2026-73814 | Gitea repository ownership escalation by administrators | |
| CVE-2026-73535 | Gitea second-factor bypass through OpenID identity linking | |
| CVE-2026-73804 | Gitea API token scope escalation through HTTP signatures | |
| CVE-2026-73539 | Gitea external renderer argument injection and code execution | |
| CVE-2026-78231 | Gitea blind SSRF through OpenID assertion verification | |
| CVE-2026-78433 | Gitea private attachment disclosure through repository mismatch | |
| CVE-2026-73130 | Gitea repository initialization resource exhaustion | |
| CVE-2026-73802 | Gitea Runner host isolation bypass through container options |
Showing top 20 of 36 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73539
Gitea external renderer argument injection and code executio
Same vendor: Gitea
-
CVE-2026-78433
Gitea private attachment disclosure through repository misma -
CVE-2026-78231
Gitea blind SSRF through OpenID assertion verification -
CVE-2026-73814
Gitea repository ownership escalation by administrators -
CVE-2026-73804
Gitea API token scope escalation through HTTP signatures -
CVE-2026-73802
Gitea Runner host isolation bypass through container options
Same weakness: CWE-94
-
CVE-2026-100159
Popup Box 6.4.1 - 6.4.2 - Unauthenticated Arbitrary Shortcod -
CVE-2026-102389
WordPress Broken Link Checker plugin <= 2.4.14.1 - Content I -
CVE-2026-86803
Ocean Extra <= 2.6.0 - Unauthenticated Arbitrary Shortcode E -
CVE-2026-54566
Markdown Preview Enhanced: Remote Code Execution via VM Sand -
CVE-2026-85714
Stirling-PDF: Remote Code Execution via H2
V. Comments for CVE-2026-73800
No comments yet