CVE-2026-94205

The Gitea Actions component is vulnerable to a workflow approval bypass when a maintainer triggers a pull_request activity, such as adding a label. The system incorrectly determines the need for approval based on the event triggerer (the maintainer) rather than the pull request author . This allo...