CVE Number
CVE-2026-63792
Description
CanReadWorkflowCrossRepo decides whether an Actions run may read a reusable workflow file referenced from another repository. Its "collaborative owner" branch grants cross-repository read through the collaborative-owner trust relationship without checking whether the run is a fork pull request. An earlier advisory fixed the same class of flaw in a sibling function but did not touch this one.
Details
A fork pull request opened against private repository A (no write access to A required) can read reusable workflow file contents of a different private repository B, at any git ref, provided A is private, B's Actions configuration lists A's owner as a collaborative owner (a normal use of the reusable-workflow sharing feature), and the fork pull request run is approved and runs. The workflow file path is confined to the configured workflow directories, but the git ref is caller-controlled.
CWE
CWE-280: Improper Handling of Insufficient Permissions or Privileges
Base Score:
6.3 (Moderate)
Package
gitea.dev (Go)
Affected Versions
Gitea <= 1.27.2.
Patches
Fixed in Gitea 1.27.3 (#39005, #39018).
CVSS
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Impact
Read-only disclosure of private reusable workflow file contents. No write access or code execution is granted by this issue.
Workarounds
None. Upgrade to 1.27.3.
