Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.
References
| Link | Resource |
|---|---|
| https://blog.gitea.com/release-of-28.0.0/ | Release Notes |
| https://github.com/go-gitea/gitea/pull/39399 | Patch |
| https://github.com/go-gitea/gitea/releases/tag/v28.0.0 | Release Notes |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp | Exploit Mitigation Vendor Advisory |
Configurations
History
13 Oct 2026, 16:41
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Gitea gitea
Gitea |
|
| CPE | cpe:2.3:a:gitea:gitea:*:*:*:*:*:*:*:* | |
| References | () https://blog.gitea.com/release-of-28.0.0/ - Release Notes | |
| References | () https://github.com/go-gitea/gitea/pull/39399 - Patch | |
| References | () https://github.com/go-gitea/gitea/releases/tag/v28.0.0 - Release Notes | |
| References | () https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp - Exploit, Mitigation, Vendor Advisory |
07 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 9.8 |
06 Oct 2026, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-10-06 20:17
Updated : 2026-10-13 16:41
NVD link : CVE-2026-94205
Mitre link : CVE-2026-94205
CVE.ORG link : CVE-2026-94205
JSON object : View
Products Affected
gitea
- gitea