{"id":"CVE-2026-116289","kind":"vulnerability","aliases":["CVE-2026-116289"],"related":[],"title":"Gitea: public-only tokens can register runners that receive private organization jobs","description":"Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions runner registration-token endpoint, and the runner registered with the resulting token was not limited to public repositories. Holding only such a token with `write:organization` that belongs to an owner of a public organization, an attacker could register an organization-level runner and receive jobs of the organization's private repositories that have Actions enabled, including the workflow content, Actions secrets and variables, and a task token with access to the private repository. The issue widens what the restricted token can reach; it gives nothing beyond what the owner's full account can already do.","summary":"Gitea accepted personal access tokens restricted to public resources when registering organization-level Actions runners. A runner registered with such a token can receive jobs from the organization's private repositories, exposing workflow content, Actions secrets and variables, and a task token for the private repository.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["actions","ci","gitea","runtime","self-hosted"],"not_affected_if":["actions-disabled","hosted-service","no-organization-runners"],"how_to_check":"- Run `gitea --version`. Affected and fixed versions are not yet published by Gitea (unknown); watch https://github.com/go-gitea/gitea/security/advisories and the release changelog, and move to the newest 1.27.x patch release.\n- Only matters if Actions is enabled and an organization has private repositories with Actions.\n- Review personal access tokens that have the `public-only` scope with `write:organization`; revoke ones you do not need.\n- Review organization-level Actions runners (org Settings > Actions > Runners) and remove any you do not recognize.","fix":null,"status":"open","published_at":"2026-11-01T10:18:34+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","triaged_at":"2026-11-01T10:51:40+00:00","updated_at":"2026-11-01T10:52:22+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-11-01T10:51:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Gitea: public-only tokens can register runners that receive private organization jobs","impact":"high","summary":"Gitea accepted personal access tokens restricted to public resources when registering organization-level Actions runners. A runner registered with such a token can receive jobs from the organization's private repositories, exposing workflow content, Actions secrets and variables, and a task token for the private repository.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["gitea","self-hosted","actions","ci"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Private CI jobs and their secrets leak to an attacker-registered runner","analyst_note":"Sources list only NVD; confirm affected and fixed Gitea version ranges and whether a patch is published.","how_to_check":"- Check the Gitea version with `gitea --version` and compare it to the fixed versions in the sources, which the sources do not state: unknown\n- Review whether any organization owner created personal access tokens with the `public-only` scope and `write:organization` permission\n- Review organization-level Actions runners registered recently and confirm they are expected","plain_action":"","needs_analyst":true,"not_affected_if":["no-organization-runners","actions-disabled","hosted-service"],"who_is_affected":"Teams that self-host Gitea with organization-level Actions runners and private repositories that use Actions. The attacker needs a token owned by an owner of a public organization with write:organization scope, and the exposure is limited to what that owner's full account can already reach. Instances without Actions enabled or without organization-level runners are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000722,"input_tokens":4210,"output_tokens":602,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources list only NVD; confirm affected and fixed Gitea version ranges and whether a patch is published.","search":"'-116289':16A,19A '-2026':15A,18A 'accept':28B 'access':30B,79C,163C 'account':186C 'action':20B,41B,62B,91C,148C,154C 'alreadi':188C 'attack':129C 'belong':120C 'beyond':180C 'ci':21B 'content':61B,153C 'could':130C 'cve':14A,17A 'enabl':149C 'endpoint':96C 'expos':59B 'full':185C 'gitea':1A,22B,27B,74C 'give':178C 'hold':111C 'host':26B 'includ':150C 'issu':169C 'job':13A,52B,139C 'level':40B,135C 'limit':107C 'noth':179C 'organ':12A,39B,55B,90C,118C,127C,134C,142C 'organization-level':38B,133C 'owner':123C,183C 'person':29B,78C 'privat':11A,57B,72B,144C,166C 'public':3A,34B,83C,86C,109C,126C 'public-on':2A,85C 'reach':176C 'receiv':10A,51B,138C 'regist':7A,37B,45B,100C,131C 'registr':94C 'registration-token':93C 'reject':77C 'repositori':58B,73B,110C,145C,167C 'resourc':35B,84C 'restrict':32B,81C,173C 'result':103C 'runner':8A,42B,44B,92C,99C,136C 'runtim':23B 'secret':63B,155C 'self':25B 'self-host':24B 'task':68B,160C 'token':5A,31B,49B,69B,80C,95C,104C,115C,161C,174C 'variabl':65B,157C 'widen':170C 'workflow':60B,152C 'write':117C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Gitea with organization-level Actions runners and private repositories that use Actions. The attacker needs a token owned by an owner of a public organization with write:organization scope, and the exposure is limited to what that owner's full account can already reach. Instances without Actions enabled or without organization-level runners are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116289","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116289","severity":null,"published_at":"2026-11-01T10:18:34+00:00","modified_at":"2026-11-01T10:18:34+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","fetched_at":"2026-11-01T10:49:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116289:1290","url":null,"severity":null,"published_at":"2026-11-01T10:52:22+00:00","modified_at":"2026-11-01T10:52:22+00:00","first_seen_at":"2026-11-01T10:52:22+00:00","fetched_at":"2026-11-01T10:52:22+00:00","note":"No Gitea GHSA or release note for this CVE found (searched advisories, 1.27.3 blog, changelog, 1.27.4 tracking issue). Affected and fixed versions unknown; only NVD text. Third-party HOL page lists fixed 28.3.0, which is not a Gitea version scheme, so I ignored it. Related public-only fixes shipped in 1.27.0 and 1.27.3, but none is confirmed as this CVE. Settle it by reading the Gitea GHSA or the 1.27.x changelog once published."}],"documents":[{"id":38387,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116289","title":"NVD CVE-2026-116289","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}