The Gitea API endpoint for retrieving the runner registration token is mistakenly classified as read-only, yet its operation creates a new registration token when none exists. This flaw allows an attacker who possesses a read:user‑scoped access token to generate a valid runner token and register a malicious Actions runner. Once registered, the runner can execute workflow jobs with full access to repository secrets and source code, effectively granting the attacker write access and the ability to exfiltrate or modify data. The weakness is a classic privilege‑escalation issue, reflected by CWE‑269.

The vulnerability exists in Gitea Open Source Git Server, all distributions that expose the /api/v1/user/actions/runners/registration-token endpoint. Versions prior to the 1.25.5 release are affected. No specific sub‑versions are listed, so any deployment using Gitea before 1.25.5 should be considered vulnerable.

The vulnerability is high risk, as it can lead to full repository compromise. The official CVSS score is not provided, but the impact is severe due to execution of arbitrary code in the CI environment. EPSS data is unavailable, so no numeric exploitation probability can be quoted, but the absence of a mitigated token scope makes exploitation straightforward for anyone with a leaked read token. The vulnerability is not listed in the CISA KEV catalog, but its potential for widespread impact warrants urgent remediation. The likely attack vector is via a compromised or leaked read‑only token that the attacker can use to call the endpoint and create a malicious runner.