CVE-2026-58424

published 2026-07-21

CVE-2026-58424: Gitea: Permanent Fork PR Workflow Approval Gate Bypass | Field | Value | |-------|-------| | **Identifier (researcher-assigned)** | GITEA-2026-004 | |…

high 8.9 CVSS 3.1

AV N AC L PR L UI R S C C L I H A H

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

| Field | Value |
|-------|-------|
| **Identifier (researcher-assigned)** | GITEA-2026-004 |
| **Product** | Gitea (self-hosted Git service) |
| **Component** | Gitea Actions — fork pull request approval gate |
| **Affected versions** | All Gitea releases **`v1.20.0` and later**, including the latest `main` (`1.27.0+dev-289-gb7e95cc48c`). The buggy logic was introduced in commit `edf98a2dc3` — *"Require approval to run actions for fork pull request (#22803)"*, 2023-02-24 — and has shipped unchanged since. |
| **Fixed in** | not yet (this disclosure) |
| **Authentication required** | Yes — one unprivileged Gitea account capable of forking the target repository (the default ability for every authenticated user) |
| **User interaction required** | Exactly **once** — a repository administrator must approve a single benign fork PR's workflow run from the attacker. After that, *no further interaction is ever required* for any future fork PR from the same attacker on the same repository. |
| **Discovered by** | Prakhar Porwal — `[email protected]` |
| **Live-verified on** | Gitea `main` at commit `b7e95cc48cc0e0d6fe24c89bb83da5b84a74490f`, 2026-05-24 |

---

## 1. Executive summary

Gitea Actions enforces an approval gate on workflow runs triggered by fork pull requests, so that an untrusted contributor cannot execute arbitrary workflow YAML on the maintainer's runner infrastructure without explicit consent. The gate is implemented by `ifNeedApproval()` in `services/actions/notifier_helper.go`. Its final clause skips the gate whenever the triggering user has **any** previously-approved run in the same repository:

```go
// services/actions/notifier_helper.go:423-433
if count, err := db.Count[actions_model.ActionRun](ctx, actions_model.FindRunOptions{
RepoID: repo.ID,
TriggerUserID: user.ID,
Approved: true,
}); err != nil {
return false, fmt.Errorf("CountRuns: %w", err)
} else if count > 0 {
log.Trace("do no

Affected

1 ranges

Vendor	Product	Version range	Fixed in
code.gitea.io	gitea	>= 0 < 1.26.3	1.26.3

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-285 CWE-732 CWE-863