Summary
Gitea can fail to re-check first-time fork contributor approval when workflow jobs move through certain transition and dispatch paths. Under specific job-concurrency conditions, unreviewed fork workflow code may execute on self-hosted runners, although fork secrets remain withheld and the run token remains read-only.
Gitea can fail to re-check first-time fork contributor approval when workflow jobs move through certain transition and dispatch paths. Under specific job-concurrency conditions, unreviewed fork workflow code may execute on self-hosted runners, although fork secrets remain withheld and the run token remains read-only.
Affected context
This issue can arise in Gitea Actions deployments that:
- Require approval before running workflows from first-time fork contributors
- Use self-hosted runners
- Permit jobs to share job-level concurrency groups
- Process cancellation, re-emission, or dispatch transitions without consistently preserving the approval requirement
The exposure depends on workflow configuration, runner trust, and the specific job state transitions involved.
This issue can arise in Gitea Actions deployments that:
- Require approval before running workflows from first-time fork contributors
- Use self-hosted runners
- Permit jobs to share job-level concurrency groups
- Process cancellation, re-emission, or dispatch transitions without consistently preserving the approval requirement
The exposure depends on workflow configuration, runner trust, and the specific job state transitions involved.
Exploit preconditions
- Attack surface: Gitea Actions workflow scheduling and job dispatch
- Required access: Ability to submit or influence a fork-based workflow and create conditions involving a shared job-level concurrency group
- Trigger point: Cancellation and subsequent re-emission or dispatch of pending jobs
- Why exploitation is possible: Some transition paths do not re-evaluate whether the workflow run still requires first-time contributor approval before dispatching it to a runner
- Attack surface: Gitea Actions workflow scheduling and job dispatch
- Required access: Ability to submit or influence a fork-based workflow and create conditions involving a shared job-level concurrency group
- Trigger point: Cancellation and subsequent re-emission or dispatch of pending jobs
- Why exploitation is possible: Some transition paths do not re-evaluate whether the workflow run still requires first-time contributor approval before dispatching it to a runner
Why this happens
The underlying flaw is an authorization-state validation gap in workflow job scheduling. Gitea correctly records that certain fork-originated jobs require approval, but some state transitions can dispatch sibling jobs without re-checking that authorization decision. This maps to CWE-284: Improper Access Control, because a security-relevant execution policy is not consistently enforced across all control-flow paths.
The underlying flaw is an authorization-state validation gap in workflow job scheduling. Gitea correctly records that certain fork-originated jobs require approval, but some state transitions can dispatch sibling jobs without re-checking that authorization decision. This maps to CWE-284: Improper Access Control, because a security-relevant execution policy is not consistently enforced across all control-flow paths.
Potential impact
- Unreviewed workflow code may execute on self-hosted runners
- Runner-hosted files, tools, or network-accessible resources could be exposed
- Build artifacts or repository automation results could be altered
- Organizations may experience integrity or supply-chain risks
- The direct impact may be limited because fork secrets remain withheld and the run token remains read-only
- Unreviewed workflow code may execute on self-hosted runners
- Runner-hosted files, tools, or network-accessible resources could be exposed
- Build artifacts or repository automation results could be altered
- Organizations may experience integrity or supply-chain risks
- The direct impact may be limited because fork secrets remain withheld and the run token remains read-only
General mitigation guidance
Mitigation generally focuses on enforcing approval requirements uniformly across every workflow job transition and dispatch path.
Common defensive patterns include:
- Treating approval state as a mandatory authorization condition at final dispatch, not only at initial scheduling
- Preserving approval requirements when jobs are canceled, re-emitted, retried, or moved between states
- Applying secure-by-default isolation for workflows originating from forks
- Using restricted, ephemeral self-hosted runners for untrusted workflow code
- Reducing runner permissions, filesystem access, credentials, and network reachability
- Limiting concurrency-group interactions that allow untrusted runs to affect other pending jobs
Mitigation generally focuses on enforcing approval requirements uniformly across every workflow job transition and dispatch path.
Common defensive patterns include:
- Treating approval state as a mandatory authorization condition at final dispatch, not only at initial scheduling
- Preserving approval requirements when jobs are canceled, re-emitted, retried, or moved between states
- Applying secure-by-default isolation for workflows originating from forks
- Using restricted, ephemeral self-hosted runners for untrusted workflow code
- Reducing runner permissions, filesystem access, credentials, and network reachability
- Limiting concurrency-group interactions that allow untrusted runs to affect other pending jobs
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis of workflow scheduling code for state transitions that bypass authorization checks
- Code review signals involving cancellation, retry, re-emission, and dispatch logic
- Tests that exercise fork approval requirements across every job lifecycle transition
- Policy checks verifying that unapproved fork jobs cannot reach self-hosted runners
- Audit-log monitoring for unapproved fork jobs dispatched after concurrency-related cancellations
- Automated security review tools that model authorization decisions across asynchronous state machines
Organizations can look for this class of issue through:
- Static analysis of workflow scheduling code for state transitions that bypass authorization checks
- Code review signals involving cancellation, retry, re-emission, and dispatch logic
- Tests that exercise fork approval requirements across every job lifecycle transition
- Policy checks verifying that unapproved fork jobs cannot reach self-hosted runners
- Audit-log monitoring for unapproved fork jobs dispatched after concurrency-related cancellations
- Automated security review tools that model authorization decisions across asynchronous state machines
Sources
| Source | Link |
|---|---|
| blog. | blog.gitea.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
| github. | github.com/ |
