Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs (CVE-2026-57897)
Gitea versions prior to 1.27.0 contain a vulnerability in the organization-level Actions API that allows any member of the organization to enumerate workflow runs and jobs across all repositories within that organization. This includes private repositories and repositories where the user lacks explicit permissions. The issue is due to missing repository-level access control checks in the API endpoints, which rely solely on organization membership for authorization.
AI Analysis
Technical Summary
CVE-2026-57897 is a vulnerability in Gitea's org-level Actions API where the API endpoints list workflow runs and jobs based only on organization membership without verifying repository-level permissions. This flaw enables any organization member to access information about workflow runs and jobs across all repositories in the organization, including private ones and those where the user has no explicit access rights. The vulnerability affects all Gitea versions before 1.27.0 and is classified under CWE-200 (Information Exposure) and CWE-863 (Incorrect Authorization).
Potential Impact
An attacker who is a member of an organization on a vulnerable Gitea instance can enumerate workflow runs and jobs across all repositories in that organization, including private repositories and those without explicit user permissions. This leads to unauthorized disclosure of potentially sensitive information about workflows and jobs. The vulnerability does not allow modification or disruption of workflows, only information disclosure.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that addresses this vulnerability by enforcing repository-level access controls on the org-level Actions API endpoints. Users should upgrade to version 1.27.0 or later to remediate this issue.
Gitea: Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs (CVE-2026-57897)
Description
Gitea versions prior to 1.27.0 contain a vulnerability in the organization-level Actions API that allows any member of the organization to enumerate workflow runs and jobs across all repositories within that organization. This includes private repositories and repositories where the user lacks explicit permissions. The issue is due to missing repository-level access control checks in the API endpoints, which rely solely on organization membership for authorization.
CVSS v3.1
Score 6.5medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-57897 is a vulnerability in Gitea's org-level Actions API where the API endpoints list workflow runs and jobs based only on organization membership without verifying repository-level permissions. This flaw enables any organization member to access information about workflow runs and jobs across all repositories in the organization, including private ones and those where the user has no explicit access rights. The vulnerability affects all Gitea versions before 1.27.0 and is classified under CWE-200 (Information Exposure) and CWE-863 (Incorrect Authorization).
Potential Impact
An attacker who is a member of an organization on a vulnerable Gitea instance can enumerate workflow runs and jobs across all repositories in that organization, including private repositories and those without explicit user permissions. This leads to unauthorized disclosure of potentially sensitive information about workflows and jobs. The vulnerability does not allow modification or disruption of workflows, only information disclosure.
Mitigation Recommendations
A patch is available in Gitea version 1.27.0 that addresses this vulnerability by enforcing repository-level access controls on the org-level Actions API endpoints. Users should upgrade to version 1.27.0 or later to remediate this issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-frpw-3h2q-4jj6
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-57897"]
- Ecosystems
- ["Go"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a600aa29c2644c7f8fdfcba
Added to database: 07/22/2026, 00:11:14 UTC
Last enriched: 08/14/2026, 12:55:21 UTC
Last updated: 09/03/2026, 22:52:13 UTC
Views: 64
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.