Security readout for executives and security teams
Plain-English summary
CVE-2026-24480 is a high-severity GitHub Actions workflow flaw in the QGIS repository. A workflow used privileged credentials while running code from untrusted pull requests, creating potential repository takeover risk. This affects the project’s source repository workflow, not ordinary QGIS desktop use based on the provided sources.
Executive priority
Treat as urgent for teams that maintain QGIS source, forks, or CI/CD workflows. The business risk is unauthorized code execution in trusted automation and possible repository compromise. For normal QGIS application users, the provided evidence does not show a direct workstation exploitation path.
Technical view
Before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9, QGIS used a `pull_request_target` workflow that checked out and executed external pull request code in a privileged context. GitHub Actions secrets and base-repository credentials could be exposed or abused. The issue is classified as CWE-863 with CVSS 4.0 score 8.7.
Likely exposure
Exposure is most relevant to QGIS repository maintainers and organizations mirroring or reusing the vulnerable workflow pattern. The provided sources identify QGIS versions before commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 as affected. No evidence is provided that installed QGIS end-user software is directly exploitable.
Exploitation context
The flaw requires an attacker to submit or influence an external pull request that causes privileged automation to run attacker-controlled code. The source bundle states the RCE/repository compromise path was validated. There is no KEV listing and no provided source states active exploitation in the wild.
Researcher notes
This is a CI/CD trust-boundary issue rather than a conventional application runtime bug. The key pattern is privileged `pull_request_target` execution of untrusted pull request code. Sources name the fixing commit but do not provide broader incident details or evidence of active exploitation.
Mitigation direction
- Apply or verify commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 in the QGIS repository.
- Review GitHub Actions workflows using `pull_request_target` for untrusted code execution.
- Avoid checking out and running external pull request code with privileged repository tokens.
- Limit workflow token permissions and access to secrets where possible.
- Check the GitHub advisory for any updated vendor guidance.
Validation and detection
- Confirm the repository includes commit 76a693cd91650f9b4e83edac525e5e4f90d954e9 or later.
- Inspect workflows for `pull_request_target` combined with external PR checkout and execution.
- Review recent workflow runs from external pull requests for suspicious activity.
- Verify workflow permissions follow least privilege and secrets are not available unnecessarily.
- Check whether downstream forks copied the vulnerable workflow.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-24480 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.7 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——Primary CVE scoreVulnerability scoring details
Base CVSS 4.0 score
8.7HighVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/qgis/QGIS/security/advisories/GHSA-7h99-4f97-h6rwCVE reference · x_refsource_CONFIRM
- https://github.com/qgis/QGIS/commit/76a693cd91650f9b4e83edac525e5e4f90d954e9CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.