CVE-2026-112887
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
59/100
Published: 2026-11-01
Modified: 2026-11-06
First seen: 2026-11-01
Status: active
Attack Surface
Network
Low Complexity
No Interaction
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
Low
UI:
None
S:
Unchanged
C:
Low
I:
None
A:
None
Description
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.
Weakness Classification (2)
References & Advisories (5)
vendor-advisory
release-notes
release-notes
patch
patch