CVE-2026-66874
CVE-2026-66874 · Gitea required Actions check bypass through skipped workflows
This page contains facts from public vulnerability sources. Check the original advisory before updating.
For pull request events, Gitea reads workflow definitions from the pull request head and posts a synthetic skipped status when workflow branch or path filters exclude execution. A fork pull request author can supply a workflow matching a required status context but deliberately prevent it from running. Because skipped statuses count as success, branch protection or organization-required workflow checks can appear satisfied without the mandated workflow executing; no runner or maintainer approval is required for this path.
CVSS 6.5 · Medium · EPSS 0.3%
- Published
- Updated
Affected products and versions
gitea
- Versions
- ≥ 0, ≤ 1.27.2: Affected (semver)
No fix published
Original sources
- https://github.com/go-gitea/gitea/security/advisories/GHSA-5xp7-r6cr-39ff
- https://blog.gitea.com/release-of-1.27.3/
- https://github.com/go-gitea/gitea/pull/39005
- https://github.com/go-gitea/gitea/pull/39018
- https://github.com/go-gitea/gitea/releases/tag/v1.27.3
- https://nvd.nist.gov/vuln/detail/CVE-2026-66874