Is CVE-2026-66877 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-66877?

CVE-2026-66877 has a CVSS v3 severity of HIGH (8.1).

Back

CVE-2026-66877

Description

Gitea enforces first-time fork contributor approval by blocking jobs, but some job transition and dispatch paths do not re-check the run's approval requirement. A separate run sharing a job-level concurrency group can cancel a pending job and cause its blocked sibling jobs to be re-emitted and dispatched without approval. This allows unreviewed workflow code to execute on self-hosted runners; fork secrets remain withheld and the run token remains read-only.