Gitea scoped workflow trust kept after repository transfer
Summary
| CVE | CVE-2026-118535 |
|---|---|
| State | PUBLISHED |
| Assigner | Gitea |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-15 22:17:17 UTC |
| Updated | 2026-11-15 22:17:17 UTC |
| Description | A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to another owner. The new owner could then change the workflows in the transferred repository, and they kept running in the previous owner's repositories with access to their Actions secrets and job tokens. A transfer now removes the owner-level registrations of the repository, and registrations whose source repository no longer belongs to the registering owner are ignored. |
Risk And Classification
Problem Types: CWE-863 | CWE-863 CWE-863: Incorrect Authorization
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/go-gitea/gitea/pull/40131 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/security/advisories/GHSA-q3q9-39vr-q35j | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/releases/tag/v28.4.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| github.com/go-gitea/gitea/pull/40281 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | github.com | |
| blog.gitea.com/release-of-28.4.0 | 88ee5874-cf24-4952-aea0-31affedb7ff2 | blog.gitea.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: https://github.com/danieltk76 (en)
CNA: https://github.com/lmonstergg (en)
CNA: https://github.com/BOTecko (en)
CNA: https://github.com/silverwind (en)
There are currently no legacy QID mappings associated with this CVE.