BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Gitea

CVE-2026-118386: Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the review

CVE-2026-118386 Nov 1, 2026 Source: Vendor

Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the fork restrictions were decided by the reviewed pull request, and the commit was not checked to belong to that pull request. A user with read access to a repository could place a commit of their own in it, through a fork pull request or an AGit push, and submit a review naming that commit on a pull request whose head branch is in the same repository. On instances with a runner servi

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-118386
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines
All 2 CVEs 2 Additional recognition 0 Unclaimed only
No lines match. , clear filters
Nothing here matches those filters. Clear them to see all 2 lines.