Gitea 28.3.0 fixes 20 flaws, from account takeover to leaked secrets

Gitea 28.3.0 fixes 20 flaws, from account takeover to leaked secrets

1 November 2026: The Gitea project released version 28.3.0 of its self-hosted Git service on 1 November together with 20 security advisories, seven rated high. The most serious allow account takeover through OAuth2 account auto-linking, hand repository secrets and a write token to workflows from forks, and run stored script on the Gitea origin. Every release up to 28.2.0 is affected, and 28.3.0 is the fixed release for all of them.

Not yet independently verified. Severity and affected ranges come from the Gitea project's own advisories; several medium and one high advisory carry no CVSS score, and the project states no exploitation either way. We will update this when it can be confirmed, and remove this note.

The seven high-severity flaws

• CVE-2026-120263: account takeover via OAuth2 auto-linking with an attacker-controlled username (no score given).
• CVE-2026-118386 (8.1): a workflow from a fork receives secrets and a write token through a review's commit ID; affects 1.19.0 onwards.
• CVE-2026-113429 (8.7): stored cross-site scripting on the Gitea origin through the Content-Encoding header of v3 Actions artifacts.
• CVE-2026-116296 (8.1): write collaborators can replace and destroy releases, milestones and labels on archived repositories.
• CVE-2026-119441 (8.1): a public-only token can delete an organisation's repositories in bulk; affects 1.27.0 onwards.
• CVE-2026-117635 (8.1): public-only tokens bypass private-resource restrictions on the admin API.
• CVE-2026-117685 (7.1): public-only package tokens can read private OCI image blobs.

The release notes match them with fixes such as "only auto-link the account the external identity points to" and "run review-triggered workflows on the pull request head".

A pattern in the medium ones

Most of the 13 medium advisories are failures of the public-only token scope, which is meant to limit a personal access token to public data. The scope leaked through RSS and Atom feeds, the contribution heatmap, profile and organisation tabs, OIDC userinfo when the token arrived as a query parameter, runner registration (which exposed private repository secrets), and a deprecated route that let such a token create private repositories. Separately, Gitea Actions task tokens could call the REST API with no scope at all, and an Actions token could add a GPG key and so spoof commits that the instance signs.

What self-hosting teams should do

Upgrade to 28.3.0; the project publishes no patched 28.2.x build. Then treat tokens as possibly exposed: rotate secrets stored in repositories that accept pull requests from forks, and review personal access tokens issued with the public-only scope, since several advisories show that scope did not hold. Instances that sign in through an external OAuth2 or OpenID provider with auto-linking turned on should check recent account links for names that do not match the identity provider.

Our source code management software category lists 17 products, and our DevOps software category 17.

Related on TrustList:

• GitLab patches CVSS 10 remote code flaw in its CI/CD regex compiler
• TeamCity 2026.2.1 and 2026.1.5 fix more than 40 security issues
• Blacksmith raises a Sequoia-led Series C at a $1bn valuation

Sources

• Gitea: release v28.3.0 (GitHub), 1 November 2026
• Gitea: security advisories (GitHub), 1 November 2026