CVE-2026-118535

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118535", "assignerOrgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "state": "PUBLISHED", "assignerShortName": "Gitea", "dateReserved": "2026-11-15T20:29:37.628Z", "datePublished": "2026-11-15T21:13:44.684Z", "dateUpdated": "2026-11-15T21:13:44.684Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "88ee5874-cf24-4952-aea0-31affedb7ff2", "shortName": "Gitea", "dateUpdated": "2026-11-15T21:13:44.684Z"}, "title": "Gitea scoped workflow trust kept after repository transfer", "descriptions": [{"lang": "en", "value": "A repository registered by its owner as a source of scoped workflows kept that registration when it was transferred to another owner. The new owner could then change the workflows in the transferred repository, and they kept running in the previous owner's repositories with access to their Actions secrets and job tokens. A transfer now removes the owner-level registrations of the repository, and registrations whose source repository no longer belongs to the registering owner are ignored."}], "affected": [{"vendor": "Gitea", "product": "Gitea", "packageName": "gitea.dev", "defaultStatus": "unaffected", "versions": [{"version": "1.27.0", "status": "affected", "lessThan": "28.4.0", "versionType": "semver"}]}], "references": [{"url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-q3q9-39vr-q35j", "name": "GitHub Security Advisory GHSA-q3q9-39vr-q35j", "tags": ["vendor-advisory"]}, {"url": "https://github.com/go-gitea/gitea/pull/40131", "name": "Fix: go-gitea/gitea pull request #40131", "tags": ["patch"]}, {"url": "https://github.com/go-gitea/gitea/pull/40281", "name": "Fix backport to release/v28: go-gitea/gitea pull request #40281", "tags": ["patch"]}, {"url": "https://blog.gitea.com/release-of-28.4.0/", "name": "Gitea 28.4.0 release announcement", "tags": ["release-notes"]}, {"url": "https://github.com/go-gitea/gitea/releases/tag/v28.4.0", "name": "go-gitea/gitea v28.4.0 release", "tags": ["release-notes"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "credits": [{"lang": "en", "value": "https://github.com/danieltk76", "type": "reporter"}, {"lang": "en", "value": "https://github.com/lmonstergg", "type": "reporter"}, {"lang": "en", "value": "https://github.com/BOTecko", "type": "reporter"}, {"lang": "en", "value": "https://github.com/silverwind", "type": "remediation developer"}]}}}

{}

{}

{}

{}