CVE-2026-103670: Gitea Vulnerability in Workflow Cancellation by Unapproved Fork Runs
Summary
CVE-2026-103670: Gitea trusted workflow cancellation by unapproved fork runs. Affects gitea versions < 28.0.0. Fixed in 28.0.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is an open-source self-hosted Git service that provides a user-friendly interface for managing Git repositories. It supports collaborative development through features like pull requests, issue tracking, and CI/CD workflows via Gitea Actions. This vulnerability affects Gitea's workflow management, specifically in how it handles concurrent actions from forked repositories.
Vulnerability Detail
The vulnerability arises from the way Gitea Actions manages concurrency groups. When a new run is initiated, older runs in the same group are cancelled without verifying if the new run requires approval. This flaw allows users to cancel trusted in-progress runs from forked pull requests, potentially disrupting deployments and leaving the system in an inconsistent state. The issue is particularly critical for self-hosted runners, where such interruptions can lead to partial deployments and operational issues.
How To Fix
Minimum fixed version
28.0.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the cancel-in-progress feature for workflows that may be affected by this vulnerability. This can be done by modifying the workflow configuration to prevent automatic cancellation of older runs.
Conclusion
CVE-2026-103670 presents a significant risk to Gitea users, particularly those using forked repositories. It is crucial to update to the patched version to mitigate the risk of unauthorized cancellations of workflow runs. Temporary workarounds can help, but a permanent fix is recommended.
See every vulnerability recorded for gitea →
FAQ
CVE-2026-103670 is a security vulnerability in Gitea that allows unapproved fork runs to cancel trusted workflow executions.
Users of Gitea who utilize forked repositories for pull requests and have enabled the cancel-in-progress feature are at risk.
The vulnerability can lead to unintended cancellations of in-progress deployments, causing partial states and operational disruptions.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider disabling the cancel-in-progress feature as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for gitea.
