CVE-2026-63792: Gitea private reusable workflow disclosure to fork runs
Gitea's collaborative-owner authorization path for reading cross-repository reusable workflows does not exclude fork pull request runs. An approved fork workflow targeting a private repository can read workflow files from another private repository that trusts the base repository's owner through collaborative-owner configuration. The issue exposes private reusable workflow contents at caller-selected Git refs; it does not itself grant write access or code execution in the other repository.
Affected Software
Event History
Frequently Asked Questions
What conditions must be present for disclosure to occur?
An approved workflow run from a fork must target a private repository, and another private repository must trust the base repository's owner through collaborative-owner configuration.
What access does successful exploitation provide?
It allows reading private reusable workflow files from the trusting private repository at attacker-selected Git references. It does not itself provide write access or code execution in that repository.