CVE-2026-73800: Gitea reusable workflow secret exposure in pull_request_target

Vulnerability summary

CVE-2026-73800 is a high (CVSS 8.8) Code Injection vulnerability in gitea. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 44.3% of scored vulnerabilities.

Timeline

1. 14-10-2026
   PublishedVulnerability first disclosed.
2. 18-10-2026
   Last modifiedVulnerability information updated.

Description

Gitea resolves local reusable workflow files from a fork's head commit when a trusted base-branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so attacker-controlled code executes with the repository and organization secrets available to that event. Exploitation requires a base workflow that calls a local reusable workflow, and bypasses the intended separation between trusted base code and untrusted fork code.

• CWE-94Improper Control of Generation of Code ('Code Injection')The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
• CWE-829Inclusion of Functionality from Untrusted Control SphereThe product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.