---
id: CVE-2026-109553
title: Gitea SSH certificate principal impersonation of other users
summary: >-
  Gitea resolved the principals of an SSH certificate by searching the content
  of all stored public keys instead of only principal keys. When Gitea trusts a
  user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary
  prin…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: adp
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev <= 28.1.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-19T20:19:01.147709Z'
published: '2026-10-18'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T20:19:06.039Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109553'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3'
    label: GitHub Security Advisory GHSA-vcp6-2qc6-gvq3
  - url: 'https://github.com/go-gitea/gitea/pull/39839'
    label: 'Fix: go-gitea/gitea pull request #39839'
  - url: 'https://github.com/go-gitea/gitea/pull/39847'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39847'
  - url: 'https://blog.gitea.com/release-of-28.2.0/'
    label: Gitea 28.2.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.2.0'
    label: go-gitea/gitea v28.2.0 release
tags:
  - cve.org
ingestedAt: '2026-10-18T19:51:12.340Z'
epss: 0.00198
epssPercentile: 0.09408
---

## Overview

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

## Affected

- `gitea.dev <= 28.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.