Gitea Permanent Fork PR Workflow Approval Gate Bypass Vulnerability

A vulnerability exists in Gitea's Actions feature, specifically in the handling of fork pull request approvals. When a pull request is made from a fork, Gitea requires approval before the associated workflow can run. However, the approval gate can be permanently bypassed. Once a repository administrator approves a workflow run from a fork PR, Gitea trusts that contributor for all future PRs from the same account on that repository, regardless of the workflow content. This flaw allows an attacker to execute arbitrary code on the repository's CI runner without further consent, exploiting the approval granted to a benign PR.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the CI runner, with access to the repository's contents and the ability to exfiltrate data, especially from private repositories. Additionally, it can lead to poisoning the Actions cache, which could affect future workflow runs, and potentially compromise the runner host if it is not ephemeral or shares state across jobs.

Reproduction

The vulnerability can be reproduced by forking a repository and opening a pull request that adds a benign change, such as a typo fix. After this PR is approved, a second PR can be opened from the same fork with a malicious workflow change. The approval gate will be skipped, and the malicious workflow will run on the CI runner.

Remediation

Users are advised to upgrade to Gitea version 1.26.4, where this vulnerability has been fixed.