---
id: CVE-2026-71184
title: >-
  Gitea's pull request review notifier does not attach the pull request to the
  Actions notification, so the fork workflow approval gate does not recognize
  the run as originating from a fork
summary: >-
  Gitea's pull request review notifier does not attach the pull request to the
  Actions notification, so the fork workflow approval gate does not recognize
  the run as originating from a fork. Review comment and review approval or
  rejection …
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-863
published: '2026-10-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T16:17:52.360'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71184'
references:
  - url: 'https://blog.gitea.com/release-of-1.27.3/'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/pull/39005'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/pull/39018'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v1.27.3'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-7w2r-xwp6-mh6c'
    label: 88ee5874-cf24-4952-aea0-31affedb7ff2
tags:
  - nvd
ingestedAt: '2026-10-14T15:36:14.028Z'
---

## Overview

Gitea's pull request review notifier does not attach the pull request to the Actions notification, so the fork workflow approval gate does not recognize the run as originating from a fork. Review comment and review approval or rejection events can consequently load workflow code from the fork head and run it on the base repository's runners without the required maintainer approval. This allows execution of fork-controlled workflow code across the intended approval boundary.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.