CVE-2026-109553Gitea SSH certificate principal impersonation of other users

Beschreibung

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.

Betroffene Produkte und Versionen

Referenzen und Patches

• GitHub Security Advisory GHSA-vcp6-2qc6-gvq3 vendor-advisory
• Fix: go-gitea/gitea pull request #39839 patch
• Fix backport to release/v28: go-gitea/gitea pull request #39847 patch
• Gitea 28.2.0 release announcement release-notes
• go-gitea/gitea v28.2.0 release release-notes