CVE-2026-24059 in Gitea
Sumário
de MITRE • 13/08/2026
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.
If you want to get best quality of vulnerability data, you may have to visit VulDB.