https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 13:08:57 +0000 https://vulnerability.circl.lu/vuln/cve-2026-58416 <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)</p> <p><strong>Affected:</strong> Gitea Open Source Git Server</p> <p>Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)</p> https://vulnerability.circl.lu/vuln/cve-2026-58416 https://vulnerability.circl.lu/vuln/ghsa-fj8v-hjwv-qm88 <p><strong>Affected:</strong> Go: gitea.dev</p> <p>### Summary</p> <p>`GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — **except the collaborative-owner branch**, which is missing the `!task.IsForkPullRequest` guard that its sibling has. As a result, when a private repo **B** lists owner **A** as a collaborative owner, an **attacker-controlled fork pull-request** workflow whose base repo is owned by A is granted code-read on B — i.e. the fork&#39;s YAML can clone a third private repository it has no rights to.</p> <p>### Details</p> <p>```go // models/perm/access/repo_permission.go (v1.26.2), in GetActionsUserRepoPermission if checkSameOwnerCrossRepoAccess(ctx, taskRepo, repo, task.IsForkPullRequest) { // passes isForkPR -&gt; denies forks return maxPerm, nil } ... if taskRepo.IsPrivate { // &lt;-- NO IsForkPullRequest check here actionsUnit := repo.MustGetUnit(ctx, unit.TypeActions) if actionsUnit.ActionsConfig().IsCollaborativeOwner(taskRepo.OwnerID) { return maxPerm, nil // grants code-read to target repo B } } ```</p> <p>The sibling same-owner path correctly denies fork PRs:</p> <p>```go func checkSameOwnerCrossRepoAccess(ctx, taskRepo, targetRepo, isForkPR bool) bool { if isForkPR { return false // Fork PRs are never allowed cross-repo access to other private repositories. } ... } ```</p> <p>`taskRepo` = the repo…</p> <p><strong>Affected:</strong> Go: gitea.dev</p> <p>### Summary</p> <p>`GetActionsUserRepoPermission` (`models/perm/access/repo_permission.go`) decides whether an Actions task token may access a target repo. Its cross-repo branches each enforce a fork-PR discriminator — **except the collaborative-owner branch**, which is missing the `!task.IsForkPullRequest` guard that its sibling has. As a result, when a private repo **B** lists owner **A** as a collaborative owner, an **attacker-controlled fork pull-request** workflow whose base repo is owned by A is granted code-read on B — i.e. the fork&#39;s YAML can clone a third private repository it has no rights to.</p> <p>### Details</p> <p>```go // models/perm/access/repo_permission.go (v1.26.2), in GetActionsUserRepoPermission if checkSameOwnerCrossRepoAccess(ctx, taskRepo, repo, task.IsForkPullRequest) { // passes isForkPR -&gt; denies forks return maxPerm, nil } ... if taskRepo.IsPrivate { // &lt;-- NO IsForkPullRequest check here actionsUnit := repo.MustGetUnit(ctx, unit.TypeActions) if actionsUnit.ActionsConfig().IsCollaborativeOwner(taskRepo.OwnerID) { return maxPerm, nil // grants code-read to target repo B } } ```</p> <p>The sibling same-owner path correctly denies fork PRs:</p> <p>```go func checkSameOwnerCrossRepoAccess(ctx, taskRepo, targetRepo, isForkPR bool) bool { if isForkPR { return false // Fork PRs are never allowed cross-repo access to other private repositories. } ... } ```</p> <p>`taskRepo` = the repo…</p> https://vulnerability.circl.lu/vuln/ghsa-fj8v-hjwv-qm88