CVE-2026-73800

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description When a trusted base-branch workflow runs for a pull request target event, the system resolves local reusable workflow files from the head commit of a fork. This allows a fork author to modify a referenced reusable workflow, leading to the execution of attacker-controlled code. This process grants access to repository and organization secrets associated with the event, bypassing the intended separation between trusted base code and untrusted fork code. This issue occurs when a base workflow calls a local reusable workflow.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.