CVE-2026-116474

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description A flaw exists where the GITEA TOKEN used in Gitea Actions jobs authenticates as the gitea-actions system user. The /api/v1/user email and GPG key endpoints incorrectly accepted this system user, allowing a job to register an email address and a GPG key. Because email confirmation is not required by default, the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, enabling any user capable of running a workflow job to make commits signed with their own key appear as trusted and signed by the instance across all repositories, including pull requests to repositories where the user lacks write access. The impact is limited to the displayed signature status; enforcement mechanisms, such as required signed commits, only verify that a signature is valid and remain unaffected, and no unauthorized access is granted.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.