Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-94205

CVE-2026-94205CRITICAL

Gitea fork workflow approval bypass through maintainer-triggered events

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .0036   27.7     —

AFFECTED
  Product  Versions     Fixed
  Gitea    unspecified  —

TIMELINE
  Oct 4   Reserved by Gitea
  Oct 6   Published (CNA: Gitea)
  Oct 13  EXPLOIT PUBLISHED — CVE-2026-94205 (Gitea). Public exploit reference added.

CWE-441, CWE-863 · CNA: Gitea · CVSS v3.1 · 4 references · NVD status: Analyzed

Description

Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
October 4, 2026	Reserved	Reserved by Gitea
October 6, 2026	Published	Published (CNA: Gitea)
October 13, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-94205 (Gitea). Public exploit reference added.

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Gitea	Gitea	—	—	—

Weaknesses

CWE-441 · CWE-863

References (4)

https://blog.gitea.com/release-of-28.0.0/ [Release Notes]
https://github.com/go-gitea/gitea/pull/39399 [Patch]
https://github.com/go-gitea/gitea/releases/tag/v28.0.0 [Release Notes]
https://github.com/go-gitea/gitea/security/advisories/GHSA-xh39-mxw9-34pp [Exploit, Mitigation, Vendor Advisory]

Authoritative record: CVE-2026-94205 at cve.org

Vendors: gitea

Weaknesses: CWE-441 · CWE-863

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-94205 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.