Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-103670

When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were…

Risk score
52/100
CVSS
7.5 v3.1
Exploit chance (30 days)
0.2%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progres…
Affected
Gitea
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: GiteaTHE FLAWSTHE FIXCVE-2026-103670When a Gitea Actions run wasinserted, older runs in thesame workflow-level…CVSS 7.5 · EPSS 0%CVE-2026-94205Incorrect authorisationCVSS 9.8 · EPSS 0%CVE-2026-60004Gitea Code InjectionVulnerabilityexploitedCVE-2026-73278Authentication bypassCVSS 9.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedGiteaAMBER · PATCH THIS WEEKGiteaGitea Actions decided whether afork pull request run neededapproval based on the user whotriggered the event rather thanthe pull request author. Forpull_request activity triggeredby a maintainer during ordinary…Where it standsExploited in the wildOn CISA's exploited list since 25 AugUS federal deadline 28 AugHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.25 Aug · CISAAdded to the Known Exploited Vulnerabilities list28 Aug · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessCWE-667 (CWE-667)4 other warnings in 30 days →Same productEarlier Gitea warnings25 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

  • CVE-2026-103670: When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were… (CVSS 7.5 · EPSS 0%)
  • CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
  • CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
  • CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 25 Aug
  • US federal deadline 28 Aug

How it unfolded

  1. 25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Why it is Yellow

  • CVSS 7.5 high
  • Remotely exploitable without logging in

References

Original description

When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with `cancel-in-progress` enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind.

Last activity 6 Oct 2026. Patch Forecast updates every hour.