---
id: "CVE-2026-112887"
kind: "vulnerability"
aliases: ["CVE-2026-112887"]
title: "Gitea: Actions job tokens list every private repository on the instance"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["ci", "gitea", "gitea-actions", "runtime", "self-hosted"]
not_affected_if: ["actions-disabled", "trusted-workflow-authors-only"]
published_at: "2026-11-01T10:18:33+00:00"
first_seen_at: "2026-11-01T10:49:32+00:00"
updated_at: "2026-11-01T10:51:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-112887", "first_seen_at": "2026-11-01T10:49:32+00:00"}]
---

# Gitea: Actions job tokens list every private repository on the instance

A Gitea Actions workflow job token authenticates to the REST API as a shared system user, and filters treated that user as unrestricted. A workflow that can run can call GET /api/v1/user/repos and list every repository on the instance, including private repositories' metadata, though repository contents stay protected by per-repository permission checks.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Confirm the Gitea version with `gitea --version` or the admin dashboard.
- Check whether Gitea Actions is enabled in app.ini under the `[actions]` section.
- Review who can push workflows or run jobs on the instance.

## Timeline

- 2026-11-01T10:49:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-112887

## From the sources

Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_