CVE-2026-109553

The Gitea SSH server is vulnerable to principal impersonation due to an incorrect logic in how it resolves SSH certificate principals. The software incorrectly searches the content of all stored public keys instead of only the principal keys. This issue occurs when Gitea trusts a user certificate...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-109553 Gitea SSH certificate principal impersonation of other users

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority SSHTRUSTEDUSERCAKEYS and accepts arbitrary principals SSHAUTHORIZEDPRINCIPALSALLOW=anything, a user could register...

CVE-2026-73804

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-73804

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

EUVD-2026-101108

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

PT-2026-114277

Name of the Vulnerable Software and Affected Versions Gitea affected versions not specified Description A flaw allows a token with write:user scope to register an attacker-controlled SSH public key on the account of the token owner. API requests signed with the corresponding private key...

CVE-2026-73804: Incorrect Privilege Assignment

Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account. API requests signed with the corresponding private key authenticate as that account through HTTP Signature without API token scope information, causing route-level token scop...

CVE-2026-90679

A flaw was found in Forgejo when federation is enabled. This issue allows a remote attacker to spoof identities by submitting signature-valid ActivityPub activities attributed to any actor identity. The system fails to verify that the HTTP Signature on an incoming ActivityPub activity was produce...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

EUVD-2026-76944

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

CVE-2026-90679

Forgejo 13.0.0 through 16.0.4, when "federation ENABLED = true" is set, has a spoofing issue that affects identity integrity but does not allow account takeover or content modification. It does not verify that the HTTP Signature on an incoming ActivityPub activity was produced by the key belongin...

PT-2026-90787

Name of the Vulnerable Software and Affected Versions Forgejo versions 13.0.0 through 16.0.4 Description An identity spoofing issue exists when federation ENABLED = true is configured. The system fails to verify that the HTTP Signature of an incoming ActivityPub activity was generated by the key...

CVE-2026-52769

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-52769: Server-Side Request Forgery (SSRF)

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-52769 YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

EUVD-2026-71801

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-52769 YesWiki: Unauthenticated Server-Side Request Forgery via ActivityPub `Signature.keyId`

YesWiki is a wiki system written in PHP. From version 4.6.2 to before version 4.6.6, the POST /api/forms/formId/actor/inbox route - exposed publicly with acl:"public" - accepts an HTTP Signature header whose keyId parameter is a URL. HttpSignatureService::verifySignature parses the header and...

CVE-2026-52769

YesWiki (PHP wiki system) versions 4.6.2 through before 4.6.6 contain an unauthenticated Server-Side Request Forgery (SSRF) in the ActivityPub inbox endpoint. The route POST /api/forms/{formId}/actor/inbox (public ACL) passes the attacker-controlled keyId URL from the HTTP Signature header direct...