Gitea Open Source Git Server
The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level equivalents, as read-only because it uses a GET request. However, this endpoint creates a new runner registration token if one does not already exist. An attacker possessing a leaked `read:user`-scoped token can use this behavior to generate a registration token and register a malicious Actions runner, allowing the execution of workflow jobs with access to source code and repository secrets.