CVE-2026-71184

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-71184
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71184.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-71184
Aliases
  • GHSA-7w2r-xwp6-mh6c
Published
2026-10-14T14:37:05Z
Modified
2026-10-16T02:47:43Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Gitea fork workflow approval bypass through review events
Details

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.

Database specific 
{
    "cna_assigner":  "Gitea",
    "cwe_ids":  [
        "CWE-863"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/71xxx/CVE-2026-71184.json"
}
References

Affected packages

Git / github.com/go-gitea/gitea

Affected ranges

Type
GIT
Repo
https://github.com/go-gitea/gitea
Events
Introduced
90a7bba1f2af1b0d0ba762fc2e1f5b3878b7dbe8
Fixed
146cc3eec57174711eac0e0a0c7b38670c6e3922
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.20.0"
        },
        {
            "last_affected":  "1.27.1"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.19.0-rc0
v1.20.0-dev
v1.20.0-rc0
v1.21.0-dev
v1.21.0-rc0
v1.22.0-dev
v1.22.0-rc0
v1.22.0-rc1
v1.23.0-dev
v1.24.0-dev
v1.25.0-dev
v1.26.0-dev
v1.27.0
v1.27.0-dev
v1.27.0-rc0
v1.27.1
v1.27.2
v1.28.0-dev

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-71184.json"