CVE-2026-116474 Gitea CVE debrief

Who should care

Gitea instance administrators and users with workflow job execution capabilities should assess exposure and verify configurations to address this issue. They should review workflow jobs, monitor repository commit signatures for inconsistencies, and update to version 28.3.0 or later to mitigate the vulnerability.

Why it matters

CVE-2026-116474 allows any user who can run a workflow job to make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to, due to Gitea Actions job authentication and /api/v1/user endpoint behavior. The impact is limited to displayed signature status, with enforcement like required signed commits unaffected. Defenders should prioritize verifying Gitea instance configurations, reviewing workflow jobs, and updating to version 28.3.0 or later.

• Defenders must verify Gitea instance configurations to restrict workflow job execution and monitor repository commit signatures for inconsistencies.
• Gitea instance administrators need to update to version 28.3.0 or later to address this issue.
• The vulnerability allows any user who can run a workflow job to make commits signed with their own key show as trusted and signed by the instance.
• Displayed signature status may be impacted, while enforcement like required signed commits remains unaffected.

Technical summary

The GITEA_TOKEN of a Gitea Actions job authenticates as the gitea-actions system user, allowing job execution to register an email address and GPG key on that user without required email confirmation. Commit verification treats a key without a real owner as the instance signing key, impacting displayed signature status. This allows any user who can run a workflow job to make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to.

Defensive priority

Defenders should prioritize verifying Gitea instance configurations, reviewing workflow jobs, and updating to version 28.3.0 or later to address this issue.

Recommended defensive actions

• Verify Gitea instance configurations to restrict workflow job execution
• Review workflow jobs for suspicious activity
• Update Gitea to version 28.3.0 or later
• Monitor repository commit signatures for inconsistencies
• Perform vulnerability assessment to identify potentially exposed systems
• Review system logs for signs of exploitation
• Implement additional monitoring for Gitea instance activity

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, while Gitea references offer additional context on the fix in version 28.3.0. Defenders should verify Gitea instance configurations, review workflow jobs, and monitor repository commit signatures for inconsistencies. The vulnerability allows any user who can run a workflow job to make commits signed with their own key show as trusted and signed by the instance. Displayed signature status may be impacted, while enforcement like required signed commits remains unaffected

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.