CVE-2026-66874

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description During pull request events, the software reads workflow definitions from the pull request head and generates a synthetic skipped status if workflow branch or path filters exclude execution. An author of a fork pull request can provide a workflow that matches a required status context but intentionally prevents it from running. Since skipped statuses are treated as successful, branch protection or organization-required workflow checks may appear satisfied even though the mandatory workflow did not execute, allowing the process to proceed without runner or maintainer approval.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.