{"id":"CVE-2026-118386","kind":"vulnerability","aliases":["CVE-2026-118386"],"related":[],"title":"Gitea: review-triggered workflows run attacker commits and leak Actions secrets","description":"Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a `GITEA_TOKEN` with write access to the repository. Review-triggered workflows now run on the pull request head.","summary":"Gitea Actions read workflows from a commit named in a pull request review instead of the pull request head, so a user with read access can plant a commit and run it without approval. The attacker's workflow receives the repository's and owner's Actions secrets and a GITEA_TOKEN with write access.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gitea","fixed":["28.3.0"],"affected":"< 28.3.0 (oldest affected version not stated by Gitea)","ecosystem":"vendor"}],"ecosystems":[],"tags":["ci","gitea","gitea-actions","infrastructure","self-hosted"],"not_affected_if":["managed-hosting","no-actions-runner"],"how_to_check":"- Run `gitea --version`; versions before 28.3.0 contain the flaw (Gitea's post names 28.3.0 as the fix; it does not state the oldest affected version, so treat older releases as exposed).\n- Exposure needs a Gitea Actions runner serving the repository and users with read access you do not trust.\n- Look in .gitea/workflows (and .github/workflows) for workflows triggered by pull_request_review, and rotate Actions secrets of repositories where untrusted readers exist and review events were possible.","fix":"Upgrade Gitea to 28.3.0, which makes pull_request_review workflows run on the pull request head. Until then, disable Actions runners for repositories where untrusted users have read access, or avoid pull_request_review workflows that use secrets.","status":"open","published_at":"2026-11-01T10:18:36+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","triaged_at":"2026-11-01T10:51:28+00:00","updated_at":"2026-11-01T10:52:06+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-01T10:51:28Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Gitea: review-triggered workflows run attacker commits and leak Actions secrets","impact":"high","summary":"Gitea Actions read workflows from a commit named in a pull request review instead of the pull request head, so a user with read access can plant a commit and run it without approval. The attacker's workflow receives the repository's and owner's Actions secrets and a GITEA_TOKEN with write access.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["gitea","self-hosted","gitea-actions","ci"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker reads Actions secrets and writes repository via GITEA_TOKEN","analyst_note":"Sources do not name affected or fixed Gitea versions; check the NVD entry and Gitea release notes for the patched release.","how_to_check":"- Check the Gitea version with `gitea --version` and compare it against the fixed release in the sources.\n- Confirm whether Gitea Actions runners serve the repository, since the flaw needs a runner.\n- Review repositories for workflows triggered on pull request review events.","plain_action":"","needs_analyst":true,"not_affected_if":["no-actions-runner","managed-hosting"],"who_is_affected":"Self-hosted Gitea instances with Gitea Actions and a runner serving the repository. Instances without Actions runners, or where only trusted users have repository read access, are less exposed. The sources do not name the fixed version, so check the Gitea release notes.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4230,"output_tokens":578,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Sources do not name affected or fixed Gitea versions; check the NVD entry and Gitea release notes for the patched release.","search":"'-118386':15A,18A '-2026':14A,17A 'access':53B,82B,129C,203C 'action':11A,24B,30B,74B,188C 'agit':149C 'approv':62B,185C 'attack':7A,64B,179C 'belong':120C 'branch':164C 'check':118C 'ci':20B 'commit':8A,35B,57B,94C,100C,115C,136C,157C 'could':133C 'cve':13A,16A 'decid':107C 'fork':104C,144C 'gitea':1A,19A,21B,23B,29B,78B,199C 'gitea-act':22B 'got':197C 'head':47B,163C,217C 'host':28B 'id':101C 'infrastructur':25B 'instanc':171C 'instead':42B 'leak':10A 'name':36B,95C,155C 'owner':72B,195C 'place':134C 'plant':55B 'pull':39B,45B,87C,111C,123C,145C,160C,215C 'push':150C 'ran':183C 'read':31B,52B,91C,128C 'receiv':67B,186C 'repositori':69B,132C,169C,177C,192C,206C 'request':40B,46B,88C,112C,124C,146C,161C,216C 'restrict':105C 'review':3A,41B,89C,98C,110C,154C,208C 'review-trigg':2A,207C 'run':6A,59B,212C 'runner':174C 'secret':12A,75B,189C 'self':27B 'self-host':26B 'serv':175C 'submit':152C 'token':79B,200C 'trigger':4A,84C,209C 'user':50B,126C 'whose':162C 'without':61B,184C 'workflow':5A,32B,66B,83C,181C,210C 'write':81B,202C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Gitea instances with Actions enabled and a runner serving the repository. A user with read access (for example via a fork pull request or AGit push) can plant a commit, submit a review naming it on a pull request whose head branch is in the same repository, and the workflow runs without approval with the repository's and owner's Actions secrets and a write-capable GITEA_TOKEN. Instances without runners can skip it; fixed in 28.3.0.","tier":"B","verified":{"fix":{"at":"2026-11-01T10:52:06Z","by":"analyst","doc":"https://blog.gitea.com/release-of-28.3.0/","run_id":1289},"how_to_check":{"at":"2026-11-01T10:52:06Z","by":"analyst","doc":"https://blog.gitea.com/release-of-28.3.0/","run_id":1289}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-11-01T10:18:36+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118386","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118386","severity":null,"published_at":"2026-11-01T10:18:36+00:00","modified_at":"2026-11-01T10:18:36+00:00","first_seen_at":"2026-11-01T10:49:33+00:00","fetched_at":"2026-11-01T10:49:33+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118386:1289","url":null,"severity":null,"published_at":"2026-11-01T10:52:06+00:00","modified_at":"2026-11-01T10:52:06+00:00","first_seen_at":"2026-11-01T10:52:06+00:00","fetched_at":"2026-11-01T10:52:06+00:00","note":"Gitea 28.3.0 release post (maintainer) names fix: review-triggered workflows now run on PR head (#40099/#40117), reported by Anthropic. Lower bound of affected range not stated by Gitea; a third-party aggregator says >=1.19.0, unverified. Not exploited per sources."}],"documents":[{"id":38385,"url":"https://blog.gitea.com/release-of-28.3.0/","title":"Gitea 28.3.0 is released (security section)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":38386,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118386","title":"NVD CVE-2026-118386","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}