CVE-2026-109553

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description Gitea incorrectly resolves SSH certificate principals by searching all stored public keys instead of focusing solely on principal keys. This occurs when the system trusts a user certificate authority via SSH TRUSTED USER CA KEYS and is configured to accept arbitrary principals through SSH AUTHORIZED PRINCIPALS ALLOW=anything. Under these conditions, a user can register another user's public key as their own principal, or a certificate holder signed by the trusted authority can list it, enabling unauthorized authentication as the key owner via the built-in SSH server and the HTTP signature API.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.