Security Vulnerability in Gitea Affecting Commit Review Processes

CVE-2026-118386

What is CVE-2026-118386?

A vulnerability exists in Gitea where workflows triggered by pull request reviews can execute commands using commits not verified to belong to the pull request. This flaw allows a user with read access to introduce their own commits via a pull request in the repository, leading to potential unauthorized execution of workflows. The problematic aspect of this vulnerability is that the workflows run without approval, potentially exposing sensitive repository information, including Actions secrets and write access tokens.

References