Gitea
CVE-2026-118386: Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the review
CVE-2026-118386 Nov 1, 2026 Source: Vendor
Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner servi
Source of record
The credited names below are quoted verbatim from the vendor's own advisory:
https://nvd.nist.gov/vuln/detail/CVE-2026-118386
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.
Credited
2 lines
Showing 1–2 of 2
CVE-2026-118386
BR2026-0000-040994
unclaimed
Credited as Anthropic for reporting the issue, and to
CVE-2026-118386
BR2026-0000-040995
unclaimed
Credited as the amazing contributions from our community