CVE-2026-24059

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description The API scope middleware incorrectly classifies the 'GET /api/v1/user/actions/runners/registration-token' endpoint, as well as its owner- and repository-level equivalents, as read-only because it uses a GET request. However, this endpoint creates a new runner registration token if one does not already exist. An attacker possessing a leaked read:user-scoped token can use this behavior to generate a registration token and register a malicious Actions runner, allowing the execution of workflow jobs with access to source code and repository secrets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.