Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-104626

A user who can open a fork pull request can place workflow content with a shared run-level…

Risk score
58/100
CVSS
8.8 v3.1
Exploit chance (30 days)
0.3%
Published
6 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the ru…
Affected
Gitea
Fix
Apply the vendor's security update; see the linked advisory.
Exploitation
No known exploitation

Story map

Story map: GiteaTHE FLAWSTHE FIXCVE-2026-104626A user who can open a fork pullrequest can place workflowcontent with a shared…CVSS 8.8 · EPSS 0%CVE-2026-94205Incorrect authorisationCVSS 9.8 · EPSS 0%CVE-2026-60004Gitea Code InjectionVulnerabilityexploitedCVE-2026-73278Authentication bypassCVSS 9.8 · EPSS 0%FixApply the vendor's securityupdate; see the linked advisory.Who is exposedGiteaAMBER · PATCH THIS WEEKGiteaGitea Actions decided whether afork pull request run neededapproval based on the user whotriggered the event rather thanthe pull request author. Forpull_request activity triggeredby a maintainer during ordinary…Where it standsExploited in the wildOn CISA's exploited list since 25 AugUS federal deadline 28 AugHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.25 Aug · CISAAdded to the Known Exploited Vulnerabilities list28 Aug · DeadlineUS federal agencies must have patchedCONNECTS TOSame weaknessCWE-841 (CWE-841)8 other warnings in 30 days →Same productEarlier Gitea warnings25 in the last 90 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Gitea: Amber, patch this week. Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For pull_request activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow def…

The flaws

  • CVE-2026-104626: A user who can open a fork pull request can place workflow content with a shared run-level… (CVSS 8.8 · EPSS 0%)
  • CVE-2026-94205: Incorrect authorisation (CVSS 9.8 · EPSS 0%)
  • CVE-2026-60004: Gitea Code Injection Vulnerability (exploited)
  • CVE-2026-73278: Authentication bypass (CVSS 9.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Gitea

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 25 Aug
  • US federal deadline 28 Aug

How it unfolded

  1. 25 Aug, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 28 Aug, Deadline (official): US federal agencies must have patched

Connects to

Why it is Yellow

  • CVSS 8.8 high

References

Original description

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.

Last activity 6 Oct 2026. Patch Forecast updates every hour.