Threats tagged 'ghsa-m7qq-f4rg-v5m5'

CVE-2026-24059 is a vulnerability in Gitea Open Source Git Server where a GET API endpoint that should be read-only actually creates a new runner registration token if none exists. This occurs because the API scope middleware incorrectly treats the GET request as read-only. An attacker with a leaked read:user-scoped token can exploit this to generate a registration token and register a malicious Actions runner, which can then execute workflow jobs with access to repository secrets and source code.