Job Approval Bypass in Gitea Affects Workflow Execution

CVE-2026-66877

What is CVE-2026-66877?

The Gitea platform has a vulnerability where the approval mechanism for first-time fork contributors is not consistently enforced. While it typically requires approval, certain job transitions may allow jobs to rerun without this check. This flaw can lead to an unapproved execution of workflow code on self-hosted runners. Although fork secrets are protected and the run token remains read-only, the potential for unreviewed code execution poses a significant risk. Users should ensure they are using the latest version and review configurations to maintain security.

References