CVE-2026-66877

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.

• CWE-284

• https://blog.gitea.com/release-of-1.27.3/
• https://github.com/go-gitea/gitea/pull/39005
• https://github.com/go-gitea/gitea/pull/39018
• https://github.com/go-gitea/gitea/releases/tag/v1.27.3
• https://github.com/go-gitea/gitea/security/advisories/GHSA-v2w8-m4gr-qj65

Published

Oct 14, 2026

Last Modified

Oct 15, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-66858The protocol skip routine in several Apache Thrift bindings …8.7
• CVE-2026-66859NULL Pointer Dereference, Use of Uninitialized Variable vuln…8.7
• CVE-2026-6686FatFs R0.16 and earlier contains an uninitialized cluster ex…4.6
• CVE-2026-6687FatFs R0.16 and earlier contains a stack overflow bug in f_g…7.6
• CVE-2026-66874For pull request events, Gitea reads workflow definitions fr…6.5
• CVE-2026-66875In the Mira hormone monitor device firmware v1.7.1.47 build …8.8
• CVE-2026-66878A flaw was found in multicloud-operators-subscription. A pri…7.7
• CVE-2026-6688FatFs R0.16 and earlier contains a downstream-caller vulnera…7.6
• CVE-2026-66881Relative Path Traversal vulnerability in livebook-dev livebo…8.1
• CVE-2026-66882Improper Neutralization of Input During Web Page Generation …2.1
• CVE-2026-66883Improper Handling of Case Sensitivity vulnerability in Erlan…6.3
• CVE-2026-66884Cross-Site Request Forgery vulnerability in Erlang Ecosystem…2.1