CVE-2026-112887
No CVSS score yet. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.
Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository, organization, project and key filters treated as having no owner restriction, and the token carried no API scope to restrict user-scoped routes. A user who can run a workflow could use the job's token with `GET /api/v1/user/repos` to list every repository on the instance, including private repositories of other users and organizations, with their metadata. Repository contents remained protected by per-repository permission checks. System users now own nothing, and `/api/v1/user` routes other than `GET /api/v1/user` accept only individual and bot accounts.
- EPSS
- 0.2% estimated probability of exploitation activity in the next 30 days; 8th percentile. Scored 2026-11-01. A forecast for this CVE across the internet, not for your own systems.
- Published
- Modified
- Record from
- the NVD, synced
Ask an AI about this CVE
ChatGPTClaudePerplexityGoogle AI Mode
Show the prompt
Explain CVE-2026-112887 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-112887?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-112887?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an estimate of exploitation activity across the internet over the next 30 days, not a prediction for my systems). Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.