CVE-2026-118386

In Gitea , a logic flaw in review-triggered workflows allows an attacker with read access to execute unauthorized code. The system fails to verify that the commit referenced in a review's commit_id belongs to the reviewed pull request. By submitting a review that points to a malicious commit (via...