CVE-2026-94205

Published: Ott 06, 2026 Last Modified: Ott 06, 2026

ExploitDB:

Other exploit source:

Google Dorks:

Description

AI Translation Available

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.

441

Unintended Proxy or Intermediary ('Confused Deputy')

Draft

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Non-Repudiation Access Control

Potential Impacts:

Gain Privileges Or Assume Identity Hide Activities Execute Unauthorized Code Or Commands

Applicable Platforms

All platforms may be affected

View CWE Details

863

Incorrect Authorization

Incomplete

Abstraction: Class Structure: Simple

Common Consequences

Security Scopes Affected:

Confidentiality Integrity Access Control Availability

Potential Impacts:

Read Application Data Read Files Or Directories Modify Application Data Modify Files Or Directories Gain Privileges Or Assume Identity Bypass Protection Mechanism Execute Unauthorized Code Or Commands Dos: Crash, Exit, Or Restart Dos: Resource Consumption (Cpu) Dos: Resource Consumption (Memory) Dos: Resource Consumption (Other)