CVE-2026-104626

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.

• CWE-841

• https://blog.gitea.com/release-of-28.0.0/
• https://github.com/go-gitea/gitea/pull/39399
• https://github.com/go-gitea/gitea/releases/tag/v28.0.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-93pj-3x56-5gc2

Published

Oct 6, 2026

Last Modified

Oct 7, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-104610A security vulnerability has been detected in Tenda HG7, HG9…10
• CVE-2026-104611A vulnerability was detected in Tenda AC9 15.03.02.13. Affec…9.1
• CVE-2026-104612A vulnerability was found in SourceCodester Student Result M…4.3
• CVE-2026-104613A vulnerability was determined in CodeAstro Simple Pharmacy …6.3
• CVE-2026-104614A vulnerability was identified in CodeAstro Simple Pharmacy …6.3
• CVE-2026-104625A security flaw has been discovered in CodeAstro Simple Loan…6.3
• CVE-2026-104632Gitea Actions blocks the jobs of workflow runs from first-ti…
• CVE-2026-104633When migrating a repository from another Gitea instance, Git…
• CVE-2026-104636Gitea validated the initial remote URL for push mirrors, wik…
• CVE-2026-104637A weakness has been identified in onetwothreeneth HospitalMa…7.3
• CVE-2026-104638A security vulnerability has been detected in onetwothreenet…5.3
• CVE-2026-104651The Yaad Sarig Payment Gateway For WC WordPress plugin befor…4.3