Incorrect authorization in Gitea - CVE-2026-71184
Published: August 31, 2026
Vulnerability identifier: #VU146366
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-71184
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to execute attacker-controlled workflow code on the base repository's runners.
The vulnerability exists due to incorrect authorization in the review notifier for the pull_request_review_comment event when handling fork pull request review notifications without attaching the pull request. A remote user can open a fork pull request and submit a review with a line comment to execute attacker-controlled workflow code on the base repository's runners.
The workflow definition is loaded from the fork head, and the same code path also covers review approved and rejected events.
Affected software
Gitea
How to mitigate CVE-2026-71184
Install security update from vendor's website.
Gitea - update to 1.27.3