Live › vulnerability › CVE-2026-112887
A Gitea Actions workflow job token authenticates to the REST API as a shared system user, and filters treated that user as unrestricted. A workflow that can run can call GET /api/v1/user/repos and list every repository on the instance, including private repositories' metadata, though repository contents stay protected by per-repository permission checks.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-01 10:49 UTC. All times on this page are UTC.
Teams that self-host Gitea with Gitea Actions enabled are exposed, because any user who can run a workflow gets a job token that can read repository metadata across the instance. The sources do not give the affected version ranges or a fixed version. Instances with Actions disabled, or where only fully trusted people can run workflows, have less exposure.
No product ranges from the sources yet.
gitea --version or the admin dashboard.[actions] section.Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with GET /api/v1/user/repos to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and /api/v1/user routes other than GET /api/v1/user accept only individual and bot accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-112887")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.