{"api_version":"1","generated_at":"2026-11-05T02:27:05+00:00","cve":"CVE-2026-116474","urls":{"html":"https://cve.report/CVE-2026-116474","api":"https://cve.report/api/cve/CVE-2026-116474.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-116474","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-116474"},"summary":{"title":"Gitea Actions job token spoofing of instance-signed commits","description":"The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users.","state":"PUBLISHED","assigner":"Gitea","published_at":"2026-11-01 10:18:35","updated_at":"2026-11-01 10:18:35"},"problem_types":["CWE-347","CWE-347 CWE-347: Improper Verification of Cryptographic Signature"],"metrics":[],"references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mf6p-vqpw-3r7x","name":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mf6p-vqpw-3r7x","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://blog.gitea.com/release-of-28.3.0/","name":"https://blog.gitea.com/release-of-28.3.0/","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/40115","name":"https://github.com/go-gitea/gitea/pull/40115","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","name":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://github.com/go-gitea/gitea/pull/39945","name":"https://github.com/go-gitea/gitea/pull/39945","refsource":"88ee5874-cf24-4952-aea0-31affedb7ff2","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-116474","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116474","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Gitea","product":"Gitea","version":"affected 1.19.0 28.3.0 semver","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[{"source":"CNA","value":"https://github.com/bircni","lang":"en"}],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"116474","cve":"CVE-2026-116474","epss":"0.001080000","percentile":"0.011640000","score_date":"2026-11-02","updated_at":"2026-11-03 00:03:08"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","packageName":"gitea.dev","product":"Gitea","vendor":"Gitea","versions":[{"lessThan":"28.3.0","status":"affected","version":"1.19.0","versionType":"semver"}]}],"credits":[{"lang":"en","type":"remediation developer","value":"https://github.com/bircni"}],"descriptions":[{"lang":"en","value":"The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users."}],"problemTypes":[{"descriptions":[{"cweId":"CWE-347","description":"CWE-347: Improper Verification of Cryptographic Signature","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-11-01T09:48:38.763Z","orgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","shortName":"Gitea"},"references":[{"name":"GitHub Security Advisory GHSA-mf6p-vqpw-3r7x","tags":["vendor-advisory"],"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-mf6p-vqpw-3r7x"},{"name":"Fix: go-gitea/gitea pull request #39945","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/39945"},{"name":"Fix backport to release/v28: go-gitea/gitea pull request #40115","tags":["patch"],"url":"https://github.com/go-gitea/gitea/pull/40115"},{"name":"Gitea 28.3.0 release announcement","tags":["release-notes"],"url":"https://blog.gitea.com/release-of-28.3.0/"},{"name":"go-gitea/gitea v28.3.0 release","tags":["release-notes"],"url":"https://github.com/go-gitea/gitea/releases/tag/v28.3.0"}],"title":"Gitea Actions job token spoofing of instance-signed commits"}},"cveMetadata":{"assignerOrgId":"88ee5874-cf24-4952-aea0-31affedb7ff2","assignerShortName":"Gitea","cveId":"CVE-2026-116474","datePublished":"2026-11-01T09:48:38.763Z","dateReserved":"2026-11-01T08:50:49.248Z","dateUpdated":"2026-11-01T09:48:38.763Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-11-01 10:18:35","lastModifiedDate":"2026-11-01 10:18:35","problem_types":["CWE-347","CWE-347 CWE-347: Improper Verification of Cryptographic Signature"],"metrics":[],"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"116474","Ordinal":"1","Title":"Gitea Actions job token spoofing of instance-signed commits","CVE":"CVE-2026-116474","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"116474","Ordinal":"1","NoteData":"The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users.","Type":"Description","Title":"Gitea Actions job token spoofing of instance-signed commits"}]}}}