Security Flaw in Gitea API Allows Unauthorized Token Creation

CVE-2026-24059

What is CVE-2026-24059?

A security flaw exists in the Gitea API that permits users with a leaked read:user-scoped token to generate a new runner registration token via the GET /api/v1/user/actions/runners/registration-token endpoint. This misclassification of the endpoint as 'read-only' due to its GET request nature allows unauthorized actions to be performed. Malicious users can register a custom Actions runner, which can execute workflows with privileged access to sensitive repository secrets and source code, posing a significant risk to data integrity and confidentiality.

References