Local Code Execution Vulnerability in Gitea Affects Organization Secrets

CVE-2026-73800

What is CVE-2026-73800?

Gitea has identified a vulnerability that allows local reusable workflow files from a fork to be resolved when a trusted base-branch workflow is executed during a pull_request_target event. This vulnerability permits a fork author to modify a referenced reusable workflow, enabling the execution of potentially malicious code with access to repository and organizational secrets during the event. The exploitation necessitates a base workflow that invokes a local reusable workflow, ultimately breaching the intended security separation between trusted base code and untrusted fork code. Organizations are urged to update to the latest versions and review their workflows to mitigate this risk.

References