CVE-2026-66877

HighCVSS 8.1/10Last modified Oct 15, 2026

Description

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 15, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-668787.7A flaw was found in multicloud-operators-subscription. A privileged user, specifically a namespace administrator capable of creating Channel CVE-2026-66887.6FatFs R0.16 and earlier contains a downstream-caller vulnerability pattern associated with FatFs long filename handling. With LFN enabled, f CVE-2026-668818.1Relative Path Traversal vulnerability in livebook-dev livebook allows an attacker-authored notebook to write a file with attacker-controlled CVE-2026-668822.1Improper Neutralization of Input During Web Page Generation (XSS) vulnerability in team-alembic AshAuthentication allows reflected cross-sit CVE-2026-668836.3Improper Handling of Case Sensitivity vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.Authorize module) renders the user CVE-2026-668842.1Cross-Site Request Forgery vulnerability in Erlang Ecosystem Foundation oidcc_plug (Oidcc.Plug.AuthorizationCallback module) allows an attac CVE-2026-668856.5Cross-Site Request Forgery (CSRF) vulnerability in livebook-dev livebook allows an attacker to authenticate a victim's browser session under CVE-2026-668879.6The affected products are missing authorization on state-changing CGIs and session checks are not performed.CVE-2026-66894.3Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when s CVE-2026-668909.6The affected products use hard-coded credentials, which could allow remote access to files with root privileges where FTP is reachable.CVE-2026-668979.9A path traversal vulnerability in LXD's instance template processing allows an attacker with container edit permissions, or any user launchi CVE-2026-668989.9A path traversal vulnerability in LXD allows an attacker to manipulate file system paths during backup import and restore operations. When i