Woodpecker versions before 3.15.0 compare the pipeline author against a list of approved users. For GitLab forge driver, the pipeline author field is set from the commit author name in the webhook payload, which attackers can control. An attacker who can open a merge request from a fork can set the commit author to match an entry in the approval list, causing the approval check to succeed and the pipeline to run without the required approval. This results in execution of attacker‑controlled pipeline steps on a Woodpecker agent, including possible exfiltration of CI secrets. The weakness is a classic authorization bypass (CWE‑290).

Manufacturer: Woodpecker‑CI; product: Woodpecker; affected versions: any release prior to 3.15.0. Other forge drivers such as Gitea, Forgejo, GitHub, and Bitbucket derive the author from a vetted identity and are not impacted.

The vulnerability has a high CVSS score of 9.2, indicating a severe security impact. EPSS data is not available and the issue is not listed in the CISA KEV catalog, but the exploitability remains possible through the GitLab webhook mechanism. The likely attack vector is through a merge request from a fork, where the attacker can supply a forged commit author name. Successful exploitation results in unauthorized pipeline execution and access to any secrets supplied to the run.