The vulnerability exists in the GET /api/v1/user/actions/runners/registration-token endpoint and its owner- and repository-level equivalents in Gitea. These endpoints create a new runner registration token if none exists, but the API scope middleware mistakenly classifies the GET request as read-only. This allows an attacker possessing a leaked read:user-scoped token to mint a registration token and register a malicious Actions runner. The malicious runner can execute workflow jobs with access to sensitive repository secrets and source code, potentially leading to unauthorized data exposure or manipulation.

An attacker with a leaked read:user-scoped token can create a malicious Actions runner that executes workflow jobs with access to repository secrets and source code. This can lead to unauthorized access to sensitive information and potential compromise of the repository's integrity. The vulnerability does not require user interaction and has a network attack vector with low attack complexity and no privileges required beyond the leaked token. The confidentiality impact is high, while integrity and availability impacts are not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict the exposure of read:user-scoped tokens and monitor for unauthorized runner registrations. Avoid leaking tokens with read:user scope and consider limiting token permissions where possible.