The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.
| Vendors | Products |
|---|
References
History
Thu, 13 Aug 2026 17:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code. | |
| Title | Gitea runner registration-token GET endpoint performs a write under a read-only token scope | |
| Weaknesses | CWE-269 | |
| References |
|
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-08-13T16:48:52.623Z
Reserved: 2026-03-03T03:25:28.686Z
Link: CVE-2026-24059
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-08-13T17:17:21.887
Modified: 2026-08-13T17:17:21.887
Link: CVE-2026-24059
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-08-13T18:45:04Z