CyberRota Analysis
AI-GeneratedThe vulnerability lies in the GET /api/v1/user/actions/runners/registration-token endpoint, which incorrectly classifies a token creation action as read-only due to its HTTP method. This flaw allows an attacker with a compromised read:user-scoped token to generate a registration token, enabling the registration of a malicious Actions runner that can access sensitive repository secrets and source code. Organizations utilizing this API should prioritize addressing this issue to safeguard their repositories from potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The GET /api/v1/user/actions/runners/registration-token endpoint (and its owner- and repository-level equivalents) creates a new runner registration token if none exists, yet the API scope middleware classifies it as read-only because it is a GET request. A holder of a leaked read:user-scoped token can therefore mint a registration token and register a malicious Actions runner that executes workflow jobs with access to repository secrets and source code.