CVE-2026-109553: Gitea 0 through 28.1.0

Affected technology

Gitea · 0 through 28.1.0
Gitea

Component: Not specified by the source

What an attacker can do

The source says when Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server.