CVE-2026-103670

When a Gitea Actions run was inserted, older runs in the same workflow-level concurrency group were cancelled without checking whether the new run still needed approval. Because fork pull request runs are inserted under the base repository, a user who can open a pull request from a fork could...

CVE-2026-103670

The Gitea actions system is vulnerable to unauthorized workflow cancellation. When a new actions run is inserted into a concurrency group with cancel-in-progress enabled, the system cancels older runs without verifying if the new run requires approval. Because fork pull request runs are inserted ...