{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","source":"CNA: Gitea","vendor":"Gitea","versions":[{"lessThan":"28.3.0","status":"affected","version":"1.19.0","versionType":"semver"}]},{"ecosystem":"go","packageName":"gitea.dev","product":"gitea.dev","source":"GitHub GHSA-32h8-5xqg-h466","vendor":"","versions":[{"status":"affected","version":">= 1.19.0, <= 28.2.0","versionType":"GitHub advisory range"}]}],"cveId":"CVE-2026-118386","cwes":["CWE-863"],"description":"Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner serving the repository, the attacker's workflow then ran without approval, received the Actions secrets of the repository and its owner, and got a `GITEA_TOKEN` with write access to the repository. Review-triggered workflows now run on the pull request head.","epss":{"date":"2026-11-06","percentile":0.04081,"score":0.00149},"exploits":[],"kev":null,"metrics":[{"score":6.5,"severity":"medium","source":"ADP: CISA-ADP","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","version":"3.1"}],"modifiedAt":1793979896287,"publishedAt":1793526427487,"references":[{"source":"CNA: Gitea","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-32h8-5xqg-h466"},{"source":"CNA: Gitea","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40099"},{"source":"CNA: Gitea","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40117"},{"source":"CNA: Gitea","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.3.0/"},{"source":"CNA: Gitea","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0"},{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"url":"https://blog.gitea.com/release-of-28.3.0/"},{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"url":"https://github.com/go-gitea/gitea/pull/40099"},{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"url":"https://github.com/go-gitea/gitea/pull/40117"},{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0"},{"source":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-32h8-5xqg-h466"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-32h8-5xqg-h466"}],"remediation":[{"kind":"fix","source":"CNA: Gitea","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/go-gitea/gitea/pull/40099"},{"kind":"fix","source":"CNA: Gitea","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/go-gitea/gitea/pull/40117"},{"kind":"fix","source":"GitHub GHSA-32h8-5xqg-h466","text":"gitea.dev (go): GitHub reports patched versions 28.3.0. Check the advisory for the affected release branch.","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-32h8-5xqg-h466"}],"revision":"3eb77b4e4ef505e75a078ae88ee08d4c7d072dcb964917805baf4e67cfb25c3b","sources":[{"modifiedAt":1793979896287,"name":"CNA: Gitea","retrievedAt":1793981381796,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118386"},{"modifiedAt":1793528316187,"name":"NVD","retrievedAt":1793578570987,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118386"},{"modifiedAt":1793526150000,"name":"GitHub Security Advisories","retrievedAt":1793656210847,"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-32h8-5xqg-h466"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793981385372,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118386"}],"ssvc":{"assessedAt":1793979871233,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Gitea Actions fork workflow trust through pull request review commit","updatedAt":1793981385372}