{"id":"CVE-2026-73800","aliases":["EUVD-2026-101106","GHSA-r9ch-mqjm-g67v"],"status":"published","title":"Gitea reusable workflow secret exposure in pull_request_target","description":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00535,"percentile":0.45658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-829","CWE-94"],"published":"2026-10-14T14:37:49Z","modified":"2026-10-28T02:30:32Z","products":[{"vendor":"gitea","product":"gitea"}],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-r9ch-mqjm-g67v","tags":["vendor-advisory","advisory"]},{"url":"https://blog.gitea.com/release-of-1.27.2/","tags":["release-notes","advisory"]},{"url":"https://github.com/go-gitea/gitea/pull/38886","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/pull/38897","tags":["patch","fix"]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.27.2","tags":["release-notes","advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73800.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-73800","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-73800","title":"Gitea reusable workflow secret exposure in pull_request_target","description":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.","status":"published","published":"2026-10-14T14:37:49.783Z","modified":"2026-10-18T13:33:34.382Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-94","CWE-829"],"updated_at":"2026-11-02T13:43:22.599321Z"}],"euvd":[{"id":"EUVD-2026-101106","description":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.","status":"published","published":"2026-10-14T14:37:49Z","modified":"2026-10-18T13:33:34Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:00:00.51681Z"}],"nvd":[{"id":"CVE-2026-73800","description":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.","status":"published","published":"2026-10-14T15:17:24.56Z","modified":"2026-10-18T14:16:55.687Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-94","CWE-829"],"updated_at":"2026-11-02T14:12:58.99337Z"}],"osv":[{"id":"CVE-2026-73800","title":"Gitea reusable workflow secret exposure in pull_request_target","description":"Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.","status":"published","published":"2026-10-14T14:37:49.783Z","modified":"2026-10-28T02:30:32.73810884Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-829","CWE-94"],"updated_at":"2026-11-02T15:45:16.365946Z"}]}}