CVE-2026-116474 Details
Description
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users.
A vulnerability in Gitea's Actions feature allows users to register a GPG key and email address under the system user 'gitea-actions' (ID -2) without proper email confirmation. This is possible because the 'GITEA_TOKEN' used in Actions jobs authenticates as the 'gitea-actions' user and can access the '/api/v1/user/emails' and '/api/v1/user/gpg_keys' endpoints. Once a GPG key is registered, commits signed with that key are treated as if they were signed by the instance itself, bypassing normal trust models and creating the appearance of a trusted signature in all repositories where the commit is present, including pull requests to repositories the user cannot write to. The vulnerability does not grant any additional access or privileges, but misrepresents the authenticity of the signed commits.
Users can upgrade to Gitea version 28.3.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 1, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://blog.gitea.com/release-of-28.3.0/ | Gitea Limited | AdvisoryBundleRelease NotesVendor |
| https://github.com/go-gitea/gitea/pull/39945 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/pull/40115 | Gitea Limited | Source CodeVendor |
| https://github.com/go-gitea/gitea/releases/tag/v28.3.0 | Gitea Limited | Release NotesVendor |
| https://github.com/go-gitea/gitea/security/advisories/GHSA-mf6p-vqpw-3r7x | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-347 | Improper Verification of Cryptographic Signature | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | >= 1.19.0, <= 28.2.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | CVE Modified | CISA-ADP |
| Nov 1, 2026 | New CVE Received | Gitea Limited |