Gitea up to 28.2.x User Registration /api/v1/user behavioral workflow

Summaryinfo

A vulnerability classified as problematic has been found in Gitea up to 28.2.x. This issue affects some unknown processing of the file /api/v1/user of the component User Registration. This manipulation causes behavioral workflow. This vulnerability is handled as CVE-2026-116474. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Gitea up to 28.2.x. It has been declared as problematic. Affected by this vulnerability is some unknown processing of the file /api/v1/user of the component User Registration. The manipulation with an unknown input leads to a behavioral workflow vulnerability. The CWE definition for the vulnerability is CWE-841. The product supports a session in which more than one behavior must be performed by an actor, but it does not properly ensure that the actor performs the behaviors in the required sequence. As an impact it is known to affect integrity. The summary by CVE is:

The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and signed by the instance in every repository where they appear, including pull requests to repositories the user cannot write to. The impact is limited to the displayed signature status: enforcement such as required signed commits only checks that a signature is verified and is unaffected, and no access is gained. The `/api/v1/user` routes now reject system users.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-116474 since 11/01/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 28.3.0 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Gitea

Version

• 28.0
• 28.1
• 28.2

License

• open-source

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion