CVE-2026-116474
Deferred Deferred - Pending Action

Gitea Actions Job Token Misuse Leads to Commit Signature Spoofing

Publication date: 2026-11-01

Last updated on: 2026-11-01

Assigner: Gitea Limited

Description
The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-01
Last Modified
2026-11-01
Generated
2026-11-01
AI Q&A
2026-11-01
EPSS Evaluated
N/A
NVD
CVE-2026-116474

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Gitea Gitea 1.19.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows a regular user with access to run a Gitea Actions job to register an email address and GPG key on the system user 'gitea-actions'. The commit verification system treats this key as the instance's signing key, making commits signed by the user appear as if they were signed by the Gitea instance itself. This spoofs the trust status of commits, showing them as trusted when they are not.

Detection Guidance

Check Gitea logs for suspicious GPG key registrations by the gitea-actions user or unexpected email confirmations. Inspect commit signatures in repositories for instances where the signer appears as the Gitea instance itself instead of the actual user.

Impact Analysis

The impact is limited to misleading display and trust indicators. Commits signed by an attacker will show as trusted and signed by the Gitea instance, even though they are not. This could deceive users into believing commits are verified by the instance when they are not. No unauthorized access is gained.

Compliance Impact

The vulnerability allows a user to spoof commit signatures as the Gitea instance, which could mislead users about the authenticity of commits. This may impact compliance with standards requiring verified signatures or integrity checks, such as GDPR's data integrity principles or HIPAA's security requirements for audit trails. However, the actual enforcement of signed commits remains unaffected, limiting the direct compliance impact.

Mitigation Strategies

Upgrade Gitea to a patched version. Disable Actions if not needed. Enable email confirmation for user registrations. Restrict workflow job permissions to prevent unauthorized GPG key registrations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116474. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...