CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2026-11-01
Gitea Actions Task Token Authorization Bypass Leading to Private Repository Metadata Disclosure (CVE-2026-112887)
[Affected Scope] Gitea instances running versions prior to v28.3.0 with Gitea Actions enabled
[Impact] An attacker with workflow execution privileges can abuse the Gitea Actions job token to list and retrieve metadata for all private repositories and organizations on the instance
[Mitigation] Immediately upgrade the Gitea instance to the patched version v28.3.0 or later