Improper Handling of Insufficient Permissions or Privileges in Gitea - CVE-2026-63792
Published: August 31, 2026
Vulnerability details
The vulnerability allows a remote user to disclose sensitive information.
The vulnerability exists due to improper handling of insufficient permissions or privileges in the CanReadWorkflowCrossRepo authorization logic when processing approved fork pull request Actions runs that reference reusable workflow files from another private repository. A remote user can open a fork pull request that causes the run to read reusable workflow file contents from a different private repository to disclose sensitive information.
The issue requires repository A to be private, repository B to list A's owner as a collaborative owner, and the approved run to execute. The workflow file path is limited to configured workflow directories, but the git ref is caller-controlled.