Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Gitea | Gitea | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Wed, 14 Oct 2026 16:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
cvssV3_1
|
Wed, 14 Oct 2026 14:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository. | |
| Title | Gitea private reusable workflow disclosure to fork runs | |
| Weaknesses | CWE-280 | |
| References |
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: Gitea
Published:
Updated: 2026-10-14T15:19:19.611Z
Reserved: 2026-08-13T16:50:59.154Z
Link: CVE-2026-63792
Vulnrichment
Updated: 2026-10-14T15:19:05.127Z
NVD
Status : Deferred
Published: 2026-10-14T15:17:21.430
Modified: 2026-10-14T16:17:49.657
Link: CVE-2026-63792
Redhat
No data.
OpenCVE Enrichment
No data.
-
CWE-280
Improper Handling of Insufficient Permissions or Privileges