Homepage

CVE-2026-104626 Affecting gitea-fips-compat package, versions <28.0.0-r0

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.33% (25th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-MINIMOSLATEST-GITEAFIPSCOMPAT-20945789
  • published15 Oct 2026
  • disclosed6 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 6 Oct 2026

NewCVE-2026-104626  (opens in a new tab)

How to fix?

Upgrade Minimos:latest gitea-fips-compat to version 28.0.0-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream gitea-fips-compat package and not the gitea-fips-compat package as distributed by Minimos. See How to fix? for Minimos:latest relevant fixed versions and status.

A user who can open a fork pull request can place workflow content with a shared run-level concurrency group into a Gitea Actions run that is awaiting approval. When a later run in that group cancels the blocked job, the run becomes terminal while still marked as needing approval. If a maintainer later approves the run, Gitea passed the already-cancelled job back through concurrency preparation, set it to waiting, and made it claimable by a matching runner, executing fork-controlled workflow code. Exploitation requires the maintainer's later approval action, Actions to be enabled, and a runner that accepts the repository's jobs.