CVE-2026-104626

In Gitea , a flaw in how Actions handle run-level concurrency groups allows a user with fork pull request permissions to execute fork-controlled workflow code . An attacker can place workflow content into a run awaiting approval; if a subsequent run in the same concurrency group cancels the block...