Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) in gitea.dev
{ "url": "https://pkg.go.dev/vuln/GO-2026-6052", "review_status": "UNREVIEWED" }
"https://vuln.go.dev/ID/GO-2026-6052.json"