CVE-2026-66874

Executive Summary

CVE-2026-66874 is an improper access control flaw (CWE-284) in Gitea's handling of pull request (PR) workflow events. When a fork pull request supplies a workflow definition that matches a required status context but whose branch or path filters prevent the workflow from actually executing, Gitea posts a synthetic "skipped" status that branch protection treats as a success. A low-privileged attacker (PR:L) can therefore make mandated workflows appear satisfied without the workflow running, requiring no runner or maintainer approval. The result is a bypass of branch protection and organization-required workflow checks, enabling integration of changes that skip mandated CI/security gates (CVSS 6.5, Integrity:High).

Technical Analysis

Gitea is a self-hosted Git service that supports Actions-style workflows and integrates workflow status checks into branch protection rules and organization-level required workflows. For pull request events, the platform reads workflow definitions from the pull request head — i.e., from the contributor's branch/commit rather than exclusively from the trusted base branch.

The flaw arises from how Gitea evaluates workflow branch filters and path filters. When a workflow definition is present and its trigger context matches, but its branch or path filters evaluate to "exclude," the workflow is not scheduled for execution. Instead of leaving the required status context unsatisfied, Gitea posts a synthetic "skipped" status for that context.

The security-relevant behavior is that skipped statuses count as success for the purposes of branch protection and organization-required workflow checks. Two design weaknesses compound:

1. Untrusted definition source (head-controlled): The workflow that determines the required context comes from the PR head, which a fork author controls. The attacker authors a workflow whose context name matches the required check, but whose filters guarantee it never runs.
2. Status semantics (skipped == success): A non-executed workflow yields a status that protection logic interprets as a satisfied requirement.

No runner execution and no maintainer approval are needed on this path. The attacker therefore satisfies a mandated check without the check performing any work — bypassing the security control's intent. This is purely an access-control/status-trust issue: no code execution, no data confidentiality impact; the impact is integrity of the protected branch and the CI gate itself (CVSS I:H).

Note: no CNA title or affected version range was provided in tracked sources. The mechanism above is derived strictly from the NVD description; specific Gitea function names, file paths, or configuration keys are not asserted because they do not appear in the supplied data.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / target identification. The attacker identifies a Gitea instance where branch protection or organization-required workflows enforce a specific required status context name (the "required check"). This is typically discoverable by observing check names on existing PRs, repository settings visible to contributors, or error messaging when a PR is blocked. The attacker needs only a fork-capable account on the target — matching PR:L (low privileges, network-accessible).

2. Triggering the flaw class. The attacker forks the repository and creates a branch/PR. In the PR head, they add or modify a workflow definition such that its status context matches the required check name, while its branch filter or path filter excludes the actual changed paths/branch. Because Gitea reads workflow definitions from the PR head for pull-request events, the attacker-supplied definition governs evaluation.

3. Execution / bypass method (vulnerability class level). No payload or remote code execution is involved. The attacker simply opens/updates the PR. Gitea evaluates the head-supplied workflow, finds it filtered out, and posts a synthetic skipped status for the matching context. Branch protection treats that skipped status as a success. No runner is invoked and no maintainer approval is required for this path, so the required check is "satisfied" without the mandated workflow running.

4. Post-exploitation impact. With the required status now appearing green, the PR becomes eligible to merge under the configured protection rules. Any changes the protected workflow would have gated — security scans, mandated builds, custom organization checks — are bypassed, allowing integration of unreviewed or unvalidated content into the protected branch. This is a control-bypass (defense evasion / integrity) outcome rather than a host compromise.

Impact Assessment

CVSS 6.5 (Medium) — AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N:

• Attack Vector Network / Low complexity: Exploitable remotely with no special conditions beyond standard PR interaction.
• Privileges Low: Any account able to open a fork PR suffices; no maintainer rights needed.
• No user interaction (UI:N): A maintainer need not approve the workflow to complete the bypass path.
• Scope Unchanged: The weakness remains within the impacted Gitea repository/protection boundary.
• Confidentiality None: No direct data disclosure.
• Integrity High (I:H): The core impact — the integrity guarantee of branch protection and organization-required workflow checks is defeated; protected branches may accept changes that skipped mandated gates.

Business impact: Organizations relying on Gitea required workflows as mandatory security/quality gates (SAST, dependency scanning, build verification, license checks) can be silently bypassed. Blast radius spans repositories under the affected protection/organization-required-workflow policies; a single low-privileged fork author can undermine the assurance model for a protected branch. There is no evidence in the provided data of CISA KEV listing, active exploitation, or public exploit code.

Detection Guidance

Sigma Rule

title: Gitea Synthetic Skipped Workflow Status Bypassing Branch Protection (CVE-2026-66874)
id: 3f9a1c2e-7b64-4d21-9a08-6c1e5f2b7d10
status: experimental
description: Detects workflow run events where a required check context reports a skipped/neutral status without any runner execution, consistent with fork-PR head workflow filter abuse.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-66874
author: valtersit.com
date: 2026-01-01
logsource:
  product: gitea
  service: actions
detection:
  selection_skipped:
    event|contains: 'workflow_run'
    conclusion: 'skipped'
    runner_id: null
  selection_pr:
    event|contains: 'pull_request'
  condition: selection_skipped and selection_pr
falsepositives:
  - Legitimate workflows intentionally configured to skip on path/branch filters
level: medium
tags:
  - attack.t1195
  - cve.2026.66874

YARA Rule

rule CVE_2026_66874_Gitea_HeadWorkflow_Filter_Bypass
{
    meta:
        description = "Detects Gitea/actions workflow definitions that match a required context but are filtered to never run (head-supplied workflow abuse)"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-66874"
        date = "2026-01-01"
        cve = "CVE-2026-66874"
    strings:
        $k1 = "on:" nocase
        $k2 = "pull_request" nocase
        $f1 = "paths-ignore" nocase
        $f2 = "branches-ignore" nocase
        $f3 = "paths:" nocase
        $f4 = "branches:" nocase
        $s1 = "skipped" nocase
    condition:
        filesize < 256KB and
        $k1 and $k2 and
        ( ($f1 or $f2) or ($f3 and $f4) )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-66874 Gitea Head-Supplied Workflow Pull Request Bypass Attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/pulls"; nocase; http.request_body; content:"pull_request"; nocase; http.request_body; content:".gitea"; nocase; classtype:attempted-user; reference:cve,2026-66874; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-66874; sid:202666874; rev:1;)

Elastic Detection

// Detect synthetic skipped workflow conclusions with no runner on PR events
any where event.action in ("workflow_run.completed", "workflow_run") and
  event.outcome == "skipped" and
  gitea.workflow.event in ("pull_request", "pull_request_target") and
  not exists(gitea.runner.id)

Splunk SPL Query

index=gitea sourcetype=gitea:actions (event="workflow_run" OR event="pull_request")
| search conclusion="skipped" runner_id=""
| stats count min(_time) as firstTime max(_time) as lastTime values(pr_number) as prs
        by user, repo, workflow_context
| where count > 0
| table firstTime, lastTime, user, repo, workflow_context, prs, count

Wazuh OSSEC Rule

<group name="gitea,cve-2026-66874,">
  <rule id="202666874" level="10">
    <decoded_as>json</decoded_as>
    <field name="event">workflow_run</field>
    <field name="conclusion">skipped</field>
    <field name="event_action" type="pcre2">pull_request</field>
    <description>CVE-2026-66874: Gitea synthetic skipped workflow status on PR event may bypass branch protection</description>
    <mitre>
      <id>T1195</id>
    </mitre>
    <group>integrity_bypass,cve_2026_66874,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or version range is confirmed in the provided data; no upstream patch reference is available.

1. Immediate mitigations:

   • Do not rely solely on workflow status contexts for branch protection on repositories that accept fork PRs. Enforce required reviewers / CODEOWNERS approval so human or trusted review gates merge regardless of check status.
   • Configure organization-required workflows to evaluate definitions only from trusted/base refs where the platform allows, and treat "skipped" as unsatisfied rather than success wherever check-result policy is configurable.
   • Restrict or disable fork PR workflows on high-value repositories until a fix is available; require maintainer approval for PR-originated workflow execution.
   • Monitor for skipped statuses on required contexts (see detection rules above).

2. Patch / upgrade steps: No patch is currently available from tracked sources. Track the upstream Gitea security advisory and release notes; when a fixed release is published, upgrade affected instances promptly and re-validate branch protection check semantics. Because patch confidence is 0/4, do not assume any specific version is fixed.

3. Long-term hardening: Adopt defense-in-depth for supply-chain controls — combine required workflow checks with mandatory peer review and signed commits; treat CI status as advisory rather than authoritative for protected branches; and audit branch protection configurations to ensure no single non-executed check can satisfy a gate.

References

• NVD — CVE-2026-66874: https://nvd.nist.gov/vuln/detail/CVE-2026-66874
• MITRE CWE-284 (Improper Access Control): https://cwe.mitre.org/data/definitions/284.html
• MITRE ATT&CK T1195 (Supply Chain Compromise): https://attack.mitre.org/techniques/T1195/
• Gitea project security advisories (monitor for the corresponding fix): https://github.com/go-gitea/gitea/security/advisories
• FIRST EPSS (score not yet published for this CVE): https://www.first.org/epss/

No CISA KEV listing, threat-actor campaign, or exploit-in-the-wild evidence is present in the data provided.