{"id":"CVE-2026-104632","aliases":["BIT-gitea-2026-104632","EUVD-2026-93905","GHSA-pvjf-7jrm-6w9g"],"status":"published","title":"Gitea fork workflow approval bypass through cancel and rerun","description":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00387,"percentile":0.33236,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-285"],"published":"2026-10-06T19:22:04Z","modified":"2026-10-28T02:30:45Z","fixes":[{"ecosystem":"Bitnami","package":"gitea","fixed_in":["28.0.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"28.0.0"}]}]}],"products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-pvjf-7jrm-6w9g","tags":["vendor-advisory","Mitigation","Vendor Advisory","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/39399","tags":["patch","Patch","fix"]},{"url":"https://blog.gitea.com/release-of-28.0.0/","tags":["release-notes","Release Notes","article","advisory"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.0.0","tags":["release-notes","Release Notes","article","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104632","tags":["web","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/104xxx/CVE-2026-104632.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-104632","title":"Gitea fork workflow approval bypass through cancel and rerun","description":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.","status":"published","published":"2026-10-06T19:22:04.308Z","modified":"2026-10-07T20:21:23.687Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:20:09.448255Z"}],"euvd":[{"id":"EUVD-2026-93905","description":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.","status":"published","published":"2026-10-06T19:22:04Z","modified":"2026-10-07T20:21:23Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:33.904651Z"}],"nvd":[{"id":"CVE-2026-104632","description":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.","status":"published","published":"2026-10-06T20:17:15.237Z","modified":"2026-10-13T17:20:01.013Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-285"],"updated_at":"2026-11-02T14:12:54.809359Z"}],"osv":[{"id":"CVE-2026-104632","title":"Gitea fork workflow approval bypass through cancel and rerun","description":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.","status":"published","published":"2026-10-06T19:22:04.308Z","modified":"2026-10-28T02:30:45.127673078Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:54.236592Z"},{"id":"BIT-gitea-2026-104632","title":"Gitea fork workflow approval bypass through cancel and rerun","description":"Gitea Actions blocks the jobs of workflow runs from first-time fork pull request contributors until a maintainer approves the run. The rerun path only required a run to be finished and built the new attempt's jobs without considering the pending approval, so when a user with Actions write access cancelled a run that was awaiting approval and then re-ran it, the new jobs were created as waiting rather than blocked while the run still recorded that approval was required. Cancelling and re-running stale fork checks is a routine action that does not involve the approval control, so where Actions is enabled and a matching runner is registered, workflow code taken from the fork pull request head could run on the repository's runners without an explicit approval.","status":"published","published":"2026-10-14T08:42:38.952Z","modified":"2026-10-14T11:11:03.691478038Z","updated_at":"2026-11-02T15:28:29.999658Z"}]}}