Code Execution Vulnerability in Gitea's Pull Request Review Notifier
CVE-2026-71184

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

What is CVE-2026-71184?

A security flaw in Gitea's pull request review notifier prevents the proper attachment of pull requests to Actions notifications. This oversight allows fork workflow approvals to bypass intended security measures, enabling execution of workflow code from forked repositories on the base repository's runners without the necessary maintainer permissions. This presents a significant risk as it allows potentially malicious code from forks to run unchecked in the base environment.

Affected Version(s)

Gitea 1.20.0 <= 1.27.1

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://blog.gitea.com/release-of-1.27.3/
release-notes
https://github.com/go-gitea/gitea/pull/39005
patch

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/echoesofwhoami
https://github.com/iabdullah215
https://github.com/bircni
.