CVE-2026-94205

CRITICAL 9.8

Published 2026-10-06 · Last modified 2026-10-07

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.

ELEVATED IMPACT

Severe if exploited (CVSS 9.8), but no known exploitation and low modeled probability. Patch on a normal cadence.

Exploitation likelihood

0.4%chance of exploitation in 30 days · 28th percentile

○ In CISA KEV ○ Public exploit / PoC

Impact if exploited

9.8CVSS 3.1 · CRITICAL

ConfidentialityHigh
IntegrityHigh
AvailabilityHigh

What an attacker needs

✓Access: Reachable over the network — no local access needed
✓Privileges: No account or privileges required
✓User interaction: No user interaction needed
✓Complexity: No special conditions — reliably repeatable

✓ lowers the bar for an attacker · ⚠ raises it

Proof of concept & exploit code

reference https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp
github-search Search GitHub for public PoC repos

Test against your own equipment

curl -s https://vulnpedia.com/cve/CVE-2026-94205/poc.jsonMachine-readable PoC index for this CVE (for automation).

Listed for defensive triage, patch verification, and authorized testing on systems you own. Machine-readable: /cve/CVE-2026-94205/poc.json

Affected

Vendors Gitea

Products Gitea

Weakness (CWE)

CWE-441: : Unintended Proxy or Intermediary ('Confused Deputy')
CWE-863: : Incorrect Authorization

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Known Affected Software Configurations

Vendor	Product	Version range
Gitea	Gitea	< 28.0.0

All CVSS metrics

CRITICAL 9.8 v3.1 · ADP Primary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CRITICAL 9.8 v3.1 · NVD Secondary
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Exploits & PoC

https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp vendor-advisoryExploitMitigationVendor Advisory

Patches & mitigations

https://github.com/go-gitea/gitea/pull/39399 patchPatch
https://blog.gitea.com/release-of-28.0.0/ release-notesRelease Notes
https://github.com/go-gitea/gitea/releases/tag/v28.0.0 release-notesRelease Notes

Sources: NVD · CVE.org · EPSS