Authorization Path Vulnerability in Gitea's Collaborative Features

CVE-2026-63792

What is CVE-2026-63792?

Gitea's collaborative-owner authorization mechanism is susceptible to exposure of private reusable workflows due to the inclusion of fork pull request runs. This flaw allows an approved fork workflow associated with a private repository to gain access to workflow files from another private repository that trusts the original base repository's owner through collaborative-owner setup. While this vulnerability does not provide write access or execute code in the affected repository, it does allow unauthorized reading of sensitive workflow contents at user-specified Git references.

References