https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 15 Oct 2026 10:59:54 +0000 https://db.gcve.eu/vuln/cve-2026-71184 <p><strong>Affected:</strong> Gitea</p> <p>Gitea&#39;s pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository&#39;s runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.</p> <p><strong>Affected:</strong> Gitea</p> <p>Gitea&#39;s pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository&#39;s runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.</p> https://db.gcve.eu/vuln/cve-2026-71184