ZeroDay Findings
Sign inSign up

Findings

CVE-2026-63792

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs.

Published Oct 14, 2026 · updated Oct 14, 2026

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 14, 2026 · NIST NVD

    Detected

    Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selec

  2. Oct 14, 2026 · NIST NVD

    Updated

    Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selec

Sources

  • CVE.orgVulnerability recordCVE-2026-63792

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-63792

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-63792

    Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository

    nvd.nist.gov

References