Improper Enforcement of Behavioral Workflow in Gitea - CVE-2026-104626
Published: October 19, 2026
Vulnerability details
The vulnerability allows a remote user to execute arbitrary workflow code on a self-hosted runner and compromise the confidentiality, integrity, and availability of its host and reachable resources.
The vulnerability exists due to improper enforcement of workflow state transitions in Gitea's ApproveRuns function when processing maintainer approval of cancelled fork pull request workflows. A remote user can submit a malicious workflow with a shared run-level concurrency group, cause a later run to cancel its approval-pending job, and induce a maintainer to approve the cancelled run, causing the job to become claimable by a matching runner and execute attacker-controlled workflow steps with the runner process's operating-system and network access.