Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-116474— Gitea Actions job token spoofing of instance-signed commits

Quick assessment

Affected
Gitea Gitea
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Gitea Actions 作业中的 会以 系统用户身份进行认证。由于 的邮箱和 GPG 密钥接口接受了该用户，作业便可为其注册邮箱地址和 GPG 密钥；在默认无需邮箱确认的情况下，该地址会被直接标记为已激活。在提交验证机制中，没有真实所有者的密钥会被视为实例签名密钥。因此，任何能够运行工作流作业的用户，都可以使其使用自有密钥签名的提交，在出现该密钥的所有仓库（包括该用户无权写入的仓库中的拉取请求）中显示为“受信任”且由实例签名。 该漏洞的影响仅限于签名状态的显示：诸如“强制要求签名提交”等策略仅检查签名是否已验证

AI Predicted 5.3 Difficulty: Moderate

Affected Version Matrix 1

VendorProduct Version RangeStatus
Gitea Gitea 1.19.0< 28.3.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-116474

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Gitea Actions job token spoofing of instance-signed commits
Source: CVE Program / CVE List V5
Vulnerability Description
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
密码学签名的验证不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Gitea Gitea 1.19.0 ~ 28.3.0 -

II. Public POCs for CVE-2026-116474

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-116474

请登录查看更多情报信息。

Other References for CVE-2026-116474 (5)

Same Patch Batch · Gitea · 2026-11-01 · 20 CVEs total

CVE-2026-117649 Gitea private issue disclosure through issue dependency timeline events
CVE-2026-118386 Gitea Actions fork workflow trust through pull request review commit
CVE-2026-120263 Gitea OAuth2 account auto-linking takeover through the sign-up form
CVE-2026-112887 Gitea Actions task token private repository enumeration
CVE-2026-113429 Gitea stored XSS through legacy Actions artifact Content-Encoding
CVE-2026-114199 Gitea contribution heatmap private activity disclosure to public-only tokens
CVE-2026-116289 Gitea public-only token bypass through Actions runner registration
CVE-2026-116296 Gitea archived repository release, milestone and label modification
CVE-2026-117635 Gitea admin API public-only token scope bypass
CVE-2026-117646 Gitea private repository listing to public-only tokens on profiles
CVE-2026-119627 Gitea limited-visibility profile disclosure with public-only tokens
CVE-2026-117677 Gitea Helm chart upload decompression denial of service
CVE-2026-117685 Gitea public-only package token access to private OCI blobs
CVE-2026-118394 Gitea OAuth2 userinfo private group disclosure to public-only tokens
CVE-2026-118395 Gitea public-only token bypass in repository and organization creation
CVE-2026-118504 Gitea issue changes on archived repositories through the API
CVE-2026-119441 Gitea public-only token bypass on bulk organization repository deletion
CVE-2026-119533 Gitea private pull request disclosure on project boards
CVE-2026-119625 Gitea user and organization feed token scope bypass

IV. Related Vulnerabilities

Same product: Gitea
Same vendor: Gitea
Same weakness: CWE-347