CVE-2026-57897

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description An authorization issue exists in the organization-level Actions REST endpoints. The endpoints /api/v1/orgs/{org}/actions/runs and /api/v1/orgs/{org}/actions/jobs only verify organization membership and token validity, failing to perform per-repository Access Control List (ACL) checks. Consequently, any authenticated organization member can enumerate workflow runs and jobs from every repository within that organization, including private repositories for which the user has no explicit access or has been denied permissions.

This flaw allows an attacker to use the endpoints as a search oracle to gather sensitive metadata from private repositories, such as repository names, descriptions, clone URLs, commit SHAs, branch names, workflow filenames, commit messages, and contributor identities. This can lead to organization reconnaissance, revealing product plans, security fix windows, or internal project topologies.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.