The vulnerability arises because the API scope middleware treats the GET request to the runner registration token endpoint as read-only, but the endpoint actually creates a new token if none exists. This mismatch allows an attacker who has obtained a read:user-scoped token to mint a registration token and register a malicious GitHub Actions runner. This runner can then execute workflows with elevated privileges, potentially exposing sensitive repository secrets and source code. The issue is classified under CWE-269 (Improper Privilege Management). No patch or official remediation has been indicated in the available data.

An attacker with a leaked read:user-scoped token can escalate privileges by generating a runner registration token and registering a malicious Actions runner. This runner can execute workflow jobs with access to sensitive repository secrets and source code, potentially leading to unauthorized code execution and data exposure within the affected repositories.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict exposure of read:user-scoped tokens and monitor for unauthorized runner registrations. Avoid leaking tokens with read:user scope and consider limiting token permissions as a precaution.