CVE-2026-66874: Gitea required Actions check bypass through skipped workflows
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this bypass?
Repositories that rely on branch protection or organization-required workflow checks for pull requests are exposed when a fork pull request author can provide a workflow with the required status context. The affected path applies to pull request events.
What does an attacker need to exploit it?
An attacker needs to submit a pull request from a fork and include a workflow definition whose status context matches a required check while branch or path filters cause the workflow to be skipped. No runner access or maintainer approval is required for this path.
How can teams identify potentially affected pull requests?
Review pull requests from forks for required status contexts reported as skipped rather than executed. Pay particular attention to workflow files supplied by the pull request head that use branch or path filters to exclude execution.