{"id":"CVE-2026-112887","published":"2026-11-01T10:18:33.457","lastModified":"2026-11-01T10:18:34.510","description":"Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-200","CWE-862"],"vendors":[],"products":[],"references":[{"url":"https://blog.gitea.com/release-of-28.3.0/","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/39945","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/40115","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8r36-6j2c-3gmv","tags":[]}],"exploitRefs":[{"url":"https://github.com/go-gitea/gitea/pull/39945","tags":[]},{"url":"https://github.com/go-gitea/gitea/pull/40115","tags":[]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","tags":[]},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-8r36-6j2c-3gmv","tags":[]}],"hasPoc":true,"ai":null}