Gitea Actions Task Token Authorization Bypass Leading to Private Repository Metadata Disclosure (CVE-2026-112887)
Executive & SecOps Summary
SECOPS ASSESSMENTGitea instances running versions prior to v28.3.0 with Gitea Actions enabled
An attacker with workflow execution privileges can abuse the Gitea Actions job token to list and retrieve metadata for all private repositories and organizations on the instance
Immediately upgrade the Gitea instance to the patched version v28.3.0 or later
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Upgrade your Gitea instance to version v28.3.0 or later to resolve the vulnerability. For Docker-based deployments, pull the latest image and restart the container:
# Upgrade Gitea via Docker Compose
docker compose pull gitea
docker compose up -d2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, temporarily disable Gitea Actions in your app.ini configuration file to mitigate the risk:
; Edit /data/gitea/conf/app.ini
[actions]
ENABLED = falseRestart the Gitea service to apply the changes:
systemctl restart gitea3. Log Audit & IoC Verification Commands
Inspect Gitea access logs for unauthorized or anomalous requests to the user repositories endpoint originating from Actions runners:
# Search Gitea access logs for suspicious GET requests to the user/repos endpoint
grep 'GET /api/v1/user/repos' /var/log/gitea/gitea.log | grep -E '200|206'Scan Your Repositories for Transitive Vulnerable Dependencies in 30 Seconds
Automatically detect vulnerable packages across npm, PyPI, Maven, and Go, and open automated fix Pull Requests without breaking your build.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability stems from a flaw in how Gitea Actions task tokens authenticate and interact with the REST API. Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID. Due to insufficient validation, repository, organization, project, and key filters treated this negative ID as having no owner restrictions. Furthermore, the token carried no API scope to restrict user-scoped routes, allowing unauthorized access to sensitive endpoints.
2. Exploitation Mechanics & Attack Scenario
A user who has permission to run or trigger a workflow can craft a malicious job to extract the job's active task token. By using this token to query the GET /api/v1/user/repos endpoint, the API bypasses owner restrictions and returns a list of every repository on the instance, including private repositories belonging to other users and organizations, along with their metadata. While actual repository contents remain protected by per-repository permission checks, the exposure of repository structures and metadata poses a significant information disclosure risk.
3. Infrastructure & Business Impact
In shared or multi-tenant Gitea environments, this vulnerability allows internal users to map out the entire organization's private code structure. Attackers can leverage the leaked repository names, organization structures, and project metadata to conduct reconnaissance, identify high-value targets, and plan sophisticated secondary attacks against internal infrastructure.
Official Vendor Advisories & References
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.
Frequently Asked SecOps Questions (CVE-2026-112887)
FAQQ1. How critical is CVE-2026-112887 and is it actively exploited in the wild?
CVE-2026-112887 is rated CVSS 4.3 (MEDIUM) with a 30-day EPSS exploitation probability of 0.3%. Organizations running affected versions should prioritize patching based on network exposure.
Q2. Which vendors and products are affected by CVE-2026-112887?
Primary impacted vendors include gitea across gitea. Scope summary: All Gitea installations prior to version v28.3.0 with Gitea Actions enabled
Q3. What temporary mitigations or workarounds exist for CVE-2026-112887 before patching?
[Mitigation] Immediately upgrade the Gitea instance to the patched version v28.3.0 or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2026-112887
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (gitea)
View Category →Gitea API Heatmap Endpoint Information Disclosure Vulnerability (CVE-2026-114199)
[Affected Scope] Gitea versions prior to v28.3.0
Gitea Remote Code Execution Vulnerability via diffpatch API and Git Hooks (CVE-2026-60004)
[Affected Scope] Gitea versions prior to 1.27.1
Gitea Actions Artifact Upload Stored Cross-Site Scripting (XSS) and CSP Bypass Vulnerability (CVE-2026-113429)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
GitLab CE/EE Unauthenticated Remote Code Execution (RCE) Advisory (CVE-2026-97229)
[Affected Scope] GitLab CE/EE versions 19.2 (< 19.2.8), 19.3 (< 19.3.5), and 19.4 (< 19.4.2)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.