CVE-2026-73800

A flaw was found in Gitea. When executing an automated workflow triggered by a pull request, Gitea improperly loads local reusable workflow definitions from the untrusted fork rather than the trusted target repository. A remote attacker submitting a pull request can exploit this flaw to achieve...

CVE-2026-73800

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800 Gitea reusable workflow secret exposure in pull_request_target

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

EUVD-2026-101106

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-73800

Gitea is vulnerable to an improper control of generation of code (CWE-94) and inclusion of functionality from untrusted control sphere (CWE-829) when handling pull_request_target events. The flaw occurs because the system resolves local reusable workflow files from a fork's head commit while exec...

CVE-2026-73800

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

CVE-2026-63792 Gitea private reusable workflow disclosure to fork runs

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through...

CVE-2026-63792

Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through...

CVE-2026-73800: Improper Control of Generation of Code

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pullrequesttarget event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to tha...

PT-2026-114276

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description When a trusted base-branch workflow runs for a pull request target event, the system resolves local reusable workflow files from the head commit of a fork. This allows a fork author to modify a...

CVE-2026-63792

"CanReadWorkflowCrossRepo" decides whether an Actions run may read a reusable workflow file referenced from another repository. Its "collaborative owner" branch grants cross-repository read through the collaborative-owner trust relationship without checking whether the run is a fork pull request...

CVE-2026-87049

A flaw was found in operator-foundry. Untrusted external actors can exploit over-permissive GitHub access tokens and Google Cloud Platform GCP Workload Identity Federation credentials granted to a third-party reusable workflow. By invoking this workflow on untrusted-triggerable events without...

CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an...

CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an...

CVE-2026-39382

In CVE-2026-39382, the vulnerability arises in a dbt workflow where the prep job uses peter-evans/find-comment to fetch a comment-body, which is then interpolated into a shell command without escaping. This allows attacker-controlled text to break out of quotes and inject arbitrary shell commands...

CVE-2026-39382 dbt has a Command Injection in Reusable Workflow via Unsanitized comment-body Output

dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. Inside the reusable workflow dbt-labs/actions/blob/main/.github/workflows/open-issue-in-repo.yml, the prep job uses peter-evans/find-comment to search for an...