{"id":"CVE-2026-104626","published":"2026-10-06T20:17:15.120","lastModified":"2026-10-07T21:17:08.760","description":"A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-841"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39399","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39399","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2","tags":[]}],"hasPoc":true,"ai":{"summary":"This vulnerability allows a user to execute fork-controlled workflow code by manipulating Gitea Actions runs, requiring maintainer approval to exploit fully.","exploitability":"Exploitation is moderately difficult, requiring maintainer approval, Actions to be enabled, and a runner that accepts the repository's jobs.","blast_radius":"If exploited, the impact is high, as it can lead to execution of arbitrary code in the context of the repository.","remediation":"Disable Gitea Actions for the affected repositories or restrict access to the Actions feature.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","web","git","code-execution"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-08T08:41:44.720Z"}}