{"id":"CVE-2026-103670","published":"2026-10-06T20:17:14.717","lastModified":"2026-10-07T16:17:33.250","description":"When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with `cancel-in-progress` enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind.","cvssScore":7.5,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","cwes":["CWE-667"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39399","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4j4g-m7mr-hp5j","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39399","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-4j4g-m7mr-hp5j","tags":[]}],"hasPoc":true,"ai":{"summary":"A Gitea Actions concurrency cancellation flaw allows attackers to interrupt in-progress trusted runs without approval by creating pull requests from forks, potentially disrupting deployments on self-hosted runners.","exploitability":"Exploitation is moderately easy requiring only fork PR creation with a workflow that shares a concurrency group with cancel-in-progress enabled, no code execution needed.","blast_radius":"The impact could be significant for self-hosted runners where interrupted runs might leave partial deployment states or cause service disruptions.","remediation":"Upgrade to Gitea 2.590 or later to fix the concurrency cancellation logic.","detection":"Monitor for unexpected cancellation events in workflow run logs where fork PRs are involved, particularly when concurrent runs share the same concurrency group with cancel-in-progress enabled.","tags":["ci-cd","concurrency","gitea","workflow"],"model":"garnet-coder","analyzedAt":"2026-10-15T09:04:45.827Z"}}