CVE-2026-73126 Gitea private workflow badge token scope bypass
Attackers with limited-scope tokens can bypass restrictions to view private workflow statuses in Gitea, exposing sensitive repository activity data.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-73126?
CVE-2026-73126 is a medium-severity missing authorization vulnerability in Gitea, published on 14 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gitea's Actions workflow status badge endpoint does not enforce repository-read scope or the public-only restriction on the token authenticating the request. A token lacking read:repository, or restricted to public repositories, can retrieve the latest workflow status of a private repository accessible to its owner. This discloses private workflow status beyond the token's intended delegated permissions.
Weakness: CWE-863
Which versions are affected by CVE-2026-73126?
How do I fix CVE-2026-73126?
No fix has been published for CVE-2026-73126 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-73126 being exploited?
There is no known exploitation of CVE-2026-73126 in the wild and no public exploit code.
Sources
Also known as GHSA-r96c-jc75-rxv6.