CVE-2026-118535

not scored yet · published 2026-11-15

A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to another owner. The new owner could then change the workflows in the transferred repository, and they kept running in the previous owner's repositories with access to their Actions secrets and job tokens. A transfer now removes the owner-level registrations of the repository, and registrations whose source repository no longer belongs to the registering owner are ignored.

Weakness: CWE-863

Source: NVD CVE-2026-118535

References

• https://blog.gitea.com/release-of-28.4.0/
• https://github.com/go-gitea/gitea/pull/40131
• https://github.com/go-gitea/gitea/pull/40281
• https://github.com/go-gitea/gitea/releases/tag/v28.4.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-q3q9-39vr-q35j

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.