User Authentication Flaw in Gitea Actions by Gitea

CVE-2026-116474

What is CVE-2026-116474?

The Gitea Actions job's GITEA_TOKEN authenticates as the gitea-actions system user, allowing unauthorized registration of email addresses and GPG keys through the /api/v1/user endpoint without necessary email verification. This flaw permits any user capable of executing a workflow job to sign commits using their own key, which could mislead other users into trusting these signatures. While the displayed signature status may indicate a trusted source, enforcement mechanisms that require signed commits remain intact and unaffected. The /api/v1/user routes have since been updated to reject system users, enhancing the security of the platform.

References