BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.

Security releases

Gitea

CVE-2026-116474: The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user

CVE-2026-116474 Nov 1, 2026 Source: Vendor

The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation (the default) the address is stored as activated. Commit verification treats a key without a real owner as the instance signing key, so any user who can run a workflow job could make commits signed with their own key show as trusted and sig

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-116474
Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

2 lines
All 2 CVEs 2 Additional recognition 0 Unclaimed only
Showing 1–2 of 2 matching , clear filters
CVE-2026-116474 BR2026-0000-040977 unclaimed
Credited as Anthropic for reporting the issue, and to
CVE-2026-116474 BR2026-0000-040978 unclaimed
Credited as the amazing contributions from our community