CVE-2026-58416
published 2026-08-13CVE-2026-58416: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
PriorityP336high7.1CVSS 3.1
AVNACHPRLUINSCCHILAN
EPSS
0.25%
16.4th percentile
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gitea | gitea_open_source_git_server | <= 1.26.4 | — |
| openshift-pipelines | pipelines-pipelines-as-code-watcher-rhel9 | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
vendor_redhat7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
gitea.dev: Gitea: Information disclosure via Fork-PR Actions task
vendor_redhat·2026-08-13·CVSS 7.1
CVE-2026-58416 [HIGH] CWE-1220 gitea.dev: Gitea: Information disclosure via Fork-PR Actions task
gitea.dev: Gitea: Information disclosure via Fork-PR Actions task
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
A flaw was found in Gitea. The Fork-PR Actions task, which handles pull requests from forked repositories, can be exploited to read data from a third private repository. This occurs due to a missing guard that should prevent unauthorized access via the collaborative-owner branch. A remote attacker could leverage this vulnerability to gain unauthorized access to sensitive information.
Statement: A flaw was found in Gitea's Actions continuous integration runner logic for pull requests from forked repositories. Due to a missing permission boundary check on collaborative-owner branches, a Gitea Actions workflow
GHSA
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
ghsa·2026-07-21
CVE-2026-58416 [MEDIUM] CWE-280 Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Gitea: Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
### Summary
`GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions
task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator —
**except the collaborative-owner branch**, which is missing the `!task.IsForkPullRequest` guard that
its sibling has. As a result, when a private repo **B** lists owner **A** as a collaborative owner, an
**attacker-controlled fork pull-request** workflow whose base repo is owned by A is granted code-read
on B — i.e. the fork's YAML can clone a third private repository it has no rights to.
### Details
```go
// models/perm/access/repo_permission.go (v1.26.2),
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-58416 forgejo: Gitea: Information disclosure via Fork-PR Actions task [epel-all]
bugzilla·2026-08-20·CVSS 7.1
CVE-2026-58416 [HIGH] CVE-2026-58416 forgejo: Gitea: Information disclosure via Fork-PR Actions task [epel-all]
CVE-2026-58416 forgejo: Gitea: Information disclosure via Fork-PR Actions task [epel-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Bugzilla
CVE-2026-58416 forgejo: Gitea: Information disclosure via Fork-PR Actions task [fedora-all]
bugzilla·2026-08-20·CVSS 7.1
CVE-2026-58416 [HIGH] CVE-2026-58416 forgejo: Gitea: Information disclosure via Fork-PR Actions task [fedora-all]
CVE-2026-58416 forgejo: Gitea: Information disclosure via Fork-PR Actions task [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
Bugzilla
CVE-2026-58416 gitea.dev: Gitea: Information disclosure via Fork-PR Actions task
bugzilla·2026-08-13·CVSS 7.1
CVE-2026-58416 [HIGH] CVE-2026-58416 gitea.dev: Gitea: Information disclosure via Fork-PR Actions task
CVE-2026-58416 gitea.dev: Gitea: Information disclosure via Fork-PR Actions task
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)
2026-08-13
Published