Access Control Flaw in Gitea's Actions Runner Registration

CVE-2026-116289

What is CVE-2026-116289?

An access control vulnerability exists in Gitea that permits the registration of organization-level runners using personal access tokens restricted to public resources. When an attacker possesses a token with write:organization permissions for a public organization, they can register a runner capable of accessing workflows and sensitive information from the organization's private repositories. This flaw undermines the intended restrictions of the personal access tokens, allowing broader access than permissible under normal circumstances.

References