CVE-2026-109553

Description

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

Traduire en français

Produits concernés

• Gitea

Scores CVSS

Références

• https://blog.gitea.com/release-of-28.2.0/
• https://github.com/go-gitea/gitea/pull/39839
• https://github.com/go-gitea/gitea/pull/39847
• https://github.com/go-gitea/gitea/releases/tag/v28.2.0
• https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories