CVE-2026-112887Gitea Actions task token private repository enumeration
Açıklama
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
Kaynaklar ve yamalar
- GitHub Security Advisory GHSA-8r36-6j2c-3gmv vendor-advisory
- Fix: go-gitea/gitea pull request #39945 patch
- Fix backport to release/v28: go-gitea/gitea pull request #40115 patch
- Gitea 28.3.0 release announcement release-notes
- go-gitea/gitea v28.3.0 release release-notes