Gitea resolves local reusable workflow files from a fork's head commit when a trusted base‑branch workflow runs for a pull_request_target event. A fork author can modify a referenced reusable workflow so that attacker‑controlled code runs with the repository and organization secrets that are available to that event, effectively granting the attacker the ability to execute arbitrary code with elevated privileges.

The vulnerable product is Gitea. Versions prior to 1.27.2 are affected. The issue was addressed in the 1.27.2 release.

The vulnerability can be exploited when a base workflow invokes a local reusable workflow and the attacker controls the referenced workflow in a fork. The attack vector is a pull_request_target event initiated from a fork, requiring only the ability to push commits to the fork. The EPSS score is <1%, indicating a low exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. The CVSS score is 8.8.