Gitea Workflow Execution Bypass Vulnerability Detected in Gitea Software
CVE-2026-66874

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-66874?

The vulnerability in Gitea allows a fork pull request author to manipulate workflow definitions from the pull request head. When certain branch or path filters exclude the execution of the workflow, Gitea issues a synthetic skipped status. This outcome can mislead branch protection measures or organization-required workflow checks, making them appear satisfied even if the necessary workflow did not execute. As a result, this vulnerability permits circumvention of controls designed to maintain workflow integrity, as no runner or maintainer approval is needed for such paths.

Affected Version(s)

Gitea 0 <= 1.27.2

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39005
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/iabdullah215
https://github.com/effabinteashfaq
https://github.com/bircni
.