| Package | Affected versions | Patched versions |
|---|---|---|
| gitea | < 28.0.0 | 28.0.0 |
Gitea Actions decided whether a fork pull request run needed approval based on the user who triggered the event rather than the pull request author. For `pull_request` activity triggered by a maintainer during ordinary triage, such as adding a label, the run was created without requiring approval, while the workflow definition was still taken from the fork head. Where Actions is enabled and a matching runner is registered, fork-controlled workflow code could run on the base repository's runners without an explicit approval.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free