{"api_version":"1","generated_at":"2026-11-15T23:52:22+00:00","cve":"CVE-2026-118535","urls":{"html":"https://cve.report/CVE-2026-118535","api":"https://cve.report/api/cve/CVE-2026-118535.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-118535","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-118535"},"summary":{"title":"Gitea scoped workflow trust kept after repository transfer","description":"A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to another owner. The new owner could then change the workflows in the transferred repository, and they kept running in the previous owner's repositories with access to their Actions secrets and job tokens. A transfer now removes the owner-level registrations of the repository, and registrations whose source repository no longer belongs to the registering owner are ignored.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-15 22:17:17","updated_at":"2026-11-15 22:17:17"},"problem_types":["CWE-863","CWE-863 CWE-863: Incorrect Authorization"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/pull/40131","name":"https://github.com/go-gitea/gitea/pull/40131","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q3q9-39vr-q35j","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q3q9-39vr-q35j","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40281","name":"https://github.com/go-gitea/gitea/pull/40281","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.4.0/","name":"https://blog.gitea.com/release-of-28.4.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-118535","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118535","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 1.27.0 28.4.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/danieltk76","lang":"en"},{"source":"CNA","value":"https://github.com/lmonstergg","lang":"en"},{"source":"CNA","value":"https://github.com/BOTecko","lang":"en"},{"source":"CNA","value":"https://github.com/silverwind","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.4.0","status":"affected","version":"1.27.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"reporter","value":"https://github.com/danieltk76"},{"lang":"en","type":"reporter","value":"https://github.com/lmonstergg"},{"lang":"en","type":"reporter","value":"https://github.com/BOTecko"},{"lang":"en","type":"remediation developer","value":"https://github.com/silverwind"}],"descriptions":[{"lang":"en","value":"A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to another owner. The new owner could then change the workflows in the transferred repository, and they kept running in the previous owner's repositories with access to their Actions secrets and job tokens. A transfer now removes the owner-level registrations of the repository, and registrations whose source repository no longer belongs to the registering owner are ignored."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-863","description":"CWE-863: Incorrect Authorization","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-15T21:13:44.684Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-q3q9-39vr-q35j","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-q3q9-39vr-q35j"},{"name":"Fix: go-gitea/gitea pull request #40131","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40131"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #40281","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40281"},{"name":"Gitea 28.4.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.4.0/"},{"name":"go-gitea/gitea v28.4.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.4.0"}],"title":"Gitea scoped workflow trust kept after repository transfer"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-118535","datePublished":"2026-11-15T21:13:44.684Z","dateReserved":"2026-11-15T20:29:37.628Z","dateUpdated":"2026-11-15T21:13:44.684Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-15 22:17:17","lastModifiedDate":"2026-11-15 22:17:17","problem_types":["CWE-863","CWE-863 CWE-863: Incorrect Authorization"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"118535","Ordinal":"1","Title":"Gitea scoped workflow trust kept after repository transfer","CVE":"CVE-2026-118535","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"118535","Ordinal":"1","NoteData":"A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to another owner. The new owner could then change the workflows in the transferred repository, and they kept running in the previous owner's repositories with access to their Actions secrets and job tokens. A transfer now removes the owner-level registrations of the repository, and registrations whose source repository no longer belongs to the registering owner are ignored.","Type":"Description","Title":"Gitea scoped workflow trust kept after repository transfer"}]}}}