---
id: CVE-2026-109553
title: Gitea SSH certificate principal impersonation of other users
summary: >-
  Gitea resolved the principals of an SSH certificate by searching the content
  of all stored public keys instead of only principal keys. When Gitea trusts a
  user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary
  prin…
severity: none
vendor: Gitea
product: gitea.dev
affected:
  - gitea.dev <= 28.1.0
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T18:51:31.037Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-109553'
references:
  - url: 'https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3'
    label: GitHub Security Advisory GHSA-vcp6-2qc6-gvq3
  - url: 'https://github.com/go-gitea/gitea/pull/39839'
    label: 'Fix: go-gitea/gitea pull request #39839'
  - url: 'https://github.com/go-gitea/gitea/pull/39847'
    label: 'Fix backport to release/v28: go-gitea/gitea pull request #39847'
  - url: 'https://blog.gitea.com/release-of-28.2.0/'
    label: Gitea 28.2.0 release announcement
  - url: 'https://github.com/go-gitea/gitea/releases/tag/v28.2.0'
    label: go-gitea/gitea v28.2.0 release
tags:
  - cve.org
ingestedAt: '2026-10-18T19:51:12.340Z'
---

## Overview

Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.

## Affected

- `gitea.dev <= 28.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.