CVE-2026-116474 Gitea Actions job token spoofing of instance-signed commits

The GITEATOKEN of a Gitea Actions job authenticates as the gitea-actions system user, and the /api/v1/user email and GPG key endpoints accepted that user, so a job could register an email address and a GPG key on it; without required email confirmation the default the address is stored as...