CVE-2026-103670
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval.
Published Oct 6, 2026 · updated Oct 15, 2026 · gitea gitea
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with enabled, without approval and without running any code. On self-hosted runners this can interrupt deployments and leave partial state behind.
Timeline
Detection, updates, and resolution for this record.
Oct 6, 2026 · NIST NVD
Detected
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with enabled, without approval and without
Oct 15, 2026 · NIST NVD
Updated
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could cancel trusted in-progress runs that share a concurrency group with enabled, without approval and without
Affected
- cpe gitea/giteaversion unspecified
Sources
- CVE.orgCVE-2026-103670
Official CVE identifier
cve.org - NIST NVDCVE-2026-103670
When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from
nvd.nist.gov