CVE-2026-63792

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description The collaborative-owner authorization path for reading cross-repository reusable workflows fails to exclude fork pull request runs. This allows an approved fork workflow targeting a private repository to read workflow files from another private repository that trusts the base repository's owner via collaborative-owner configuration. This issue exposes private reusable workflow contents at caller-selected Git refs, although it does not grant write access or code execution in the target repository.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.