A flaw exists where the `GITEA TOKEN` used in Gitea Actions jobs authenticates as the `gitea-actions` system user. The `/api/v1/user` email and GPG key endpoints incorrectly accepted this system user, allowing a job to register an email address and a GPG key. Because email confirmation is not required by default, the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, enabling any user capable of running a workflow job to make commits signed with their own key appear as trusted and signed by the instance across all repositories, including pull requests to repositories where the user lacks write access. The impact is limited to the displayed signature status; enforcement mechanisms, such as required signed commits, only verify that a signature is valid and remain unaffected, and no unauthorized access is granted.