CVE-2026-57897
published 2026-08-13CVE-2026-57897: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
PriorityP434medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.41%
33.9th percentile
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.27.0 | 1.27.0 |
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
ghsa·2026-07-21
CVE-2026-57897 [MEDIUM] CWE-200 Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
**Author:** Prakhar Porwal
**Date:** 2026-05-24
**Target:** Gitea (self-hosted Git service)
**Branch tested:** `main` @ `b7e95cc48c` (development build, go1.26.3)
**Component:** `routers/api/v1/org/action.go` (org-level Actions API)
**OWASP:** API3:2023 Broken Object Property Level Authorization
---
## 1. Summary
The org-level Actions REST endpoints
```
GET /api/v1/orgs/{org}/actions/runs
GET /api/v1/orgs/{org}/actions/jobs
```
are gated only by **`reqOrgMembership()`** + `reqToken()`. They then call
`shared.ListRuns(ctx, ctx.Org.Organization.ID, 0)` /
`shared.ListJobs(ctx, ctx.Org.Organization.ID, 0, 0, nil)`, which selects
**every** `action_run` / `action_run_job` row whose repository belongs to the
org — w
Red Hat
code.gitea.io/gitea: Gitea: Information disclosure via Org-Level Actions Run/Job APIs
vendor_redhat·2026-08-13·CVSS 6.5
CVE-2026-57897 [MEDIUM] CWE-1220 code.gitea.io/gitea: Gitea: Information disclosure via Org-Level Actions Run/Job APIs
code.gitea.io/gitea: Gitea: Information disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
A flaw was found in Gitea. This vulnerability allows for cross-repository information disclosure through the use of Org-Level Actions Run/Job Application Programming Interfaces (APIs). An attacker could exploit this to gain unauthorized access to sensitive information across different repositories.
Statement: An authorization bypass vulnerability in Gitea's organization-level Actions REST API allows authenticated organization members to access workflow run and job details across all repositories within the organization. By querying the `/api/v1/orgs/{org}/actions/runs` or `/api/v1/orgs/{org}/actions/jobs` endpoints, an attacker can by
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-57897 forgejo: Gitea: Information disclosure via Org-Level Actions Run/Job APIs [epel-all]
bugzilla·2026-08-24·CVSS 6.5
CVE-2026-57897 [MEDIUM] CVE-2026-57897 forgejo: Gitea: Information disclosure via Org-Level Actions Run/Job APIs [epel-all]
CVE-2026-57897 forgejo: Gitea: Information disclosure via Org-Level Actions Run/Job APIs [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Bugzilla
CVE-2026-57897 forgejo: Gitea: Information disclosure via Org-Level Actions Run/Job APIs [fedora-all]
bugzilla·2026-08-24·CVSS 6.5
CVE-2026-57897 [MEDIUM] CVE-2026-57897 forgejo: Gitea: Information disclosure via Org-Level Actions Run/Job APIs [fedora-all]
CVE-2026-57897 forgejo: Gitea: Information disclosure via Org-Level Actions Run/Job APIs [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
Bugzilla
CVE-2026-57897 code.gitea.io/gitea: Gitea: Information disclosure via Org-Level Actions Run/Job APIs
bugzilla·2026-08-13·CVSS 6.5
CVE-2026-57897 [MEDIUM] CVE-2026-57897 code.gitea.io/gitea: Gitea: Information disclosure via Org-Level Actions Run/Job APIs
CVE-2026-57897 code.gitea.io/gitea: Gitea: Information disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs
2026-08-13
Published