Insecure Token Implementation in Gitea for REST API Authentication

CVE-2026-112887

What is CVE-2026-112887?

Gitea's Actions task tokens present a significant security risk by authenticating via a shared system user with a negative ID. This design flaw allows unrestricted access to the REST API, resulting in inadequate owner restrictions for certain endpoints. As a consequence, users executing a workflow can leverage job tokens to query /api/v1/user/repos, potentially revealing all repositories on the instance, including sensitive private repositories. Although the contents of these repositories remain safeguarded by existing permission checks, the exposure of repository metadata poses a risk to user privacy and system integrity.

References