Gitea

Latest 28.2.0 Oct 18, 2026

Recent releases

28.2.0 Oct 18, 2026 Release notes ↗ 2feature34fix

28.1.0 Oct 6, 2026 → 28.2.0 Release notes ↗ 1feature35fix

28.0.0 Sep 29, 2026 → 28.2.0 Release notes ↗ 8security3breaking29feature1deprecated

securityFixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

breakingBREAKING

breakingFix(git)!: route Git network operations through an internal proxy and update egress settings ()

1.27.3 Aug 29, 2026 → 28.2.0 Release notes ↗ 3security37fix1feature

securityFixes CVE-2026-60018: Authenticated DoS in OneDev migration via unbounded version response body

securityFixes CVE-2026-60021: Authenticated DoS in GitLab migration via uncancelable version probe

securitySECURITY

1.27.2 Aug 13, 2026 → 28.2.0 Release notes ↗ 2security27fix1feature

securityFixes CVE-2026-73800: Secret Exfiltration via Reusable Workflow Resolution in pull_request_target Events

securitySECURITY

1.27.1 Jul 27, 2026 → 28.2.0 Release notes ↗ 3security39fix

securityFixes CVE-2026-60004: Remote Code Execution via diffpatch Git Hook Installation

securityFixes CVE-2026-59774: Unauthenticated Arbitrary File Read can lead to RCE

securitySECURITY

1.27.0 Jul 13, 2026 → 28.2.0 Release notes ↗ 11security9breaking21feature

securityFixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration

breakingBREAKING

breakingFeat(actions)!: improve support for reusable workflows (#37478)

1.26.4 Jun 21, 2026 → 28.2.0 Release notes ↗ 1security2fix

securitySECURITY

1.26.3 Jun 20, 2026 → 28.2.0 Release notes ↗ 4security2breaking25fix1feature

securityFixes CVE-2026-20779: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

breakingBREAKING

breakingfix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)

1.26.2 May 20, 2026 → 28.2.0 Release notes ↗ 5security32fix2feature2breaking

securityFixes CVE-2026-58421: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

securitySECURITY

securityfix(security): enforce wiki git writes and LFS token access at request time (#37695)

1.26.1 Apr 24, 2026 → 28.2.0 Release notes ↗ 2feature12fix

1.26.0 Apr 18, 2026 → 28.2.0 Release notes ↗ 5security14breaking22feature1deprecated

securityFixes CVE-2026-28737: Stored XSS via glTF `extensionsRequired` in Gitea 3D File Viewer

securityFixes CVE-2026-22555: API Fork Missing CanCreateOrgRepo Check Allows Org Secret Exfiltration

breakingBREAKING

1.25.5 Mar 13, 2026 → 28.2.0 Release notes ↗ 2security25fix7feature

securitySECURITY

securityMake security-check informational only (#36681) (#36852)

1.25.4 Jan 22, 2026 → 28.2.0 Release notes ↗ 1security15fix2feature

securitySECURITY

1.25.3 Dec 18, 2025 → 28.2.0 Release notes ↗ 1security2feature13fix

securitySECURITY

Security advisories

low CVE-2026-97859 API routes for user social graph, keys, and starred repos bypass private visibility check

low CVE-2026-107618 Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`

3.5 CVE-2026-97204 DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels

4.3 CVE-2026-109844 Gitea watched-repos API (GET /api/v1/user/subscriptions) leaks private repository metadata after team permission downgrade

6.5 CVE-2026-110324 Private profile information leaks on POST request

6.5 CVE-2026-105964 Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS

4.3 CVE-2026-110311 Draft releases include attachment metadata from other repositories

5.3 CVE-2026-105661 Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users

6.3 CVE-2026-110494 Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases

4.3 CVE-2026-107686 Locked issues and comments still accept reactions through the web UI

8.1 CVE-2026-104627 Cross-Session OpenID Credential Linking Enables Account Takeover

7.5 CVE-2026-109553 VerifyCert maps SSH certificate principals onto other users' SSH public keys

6.5 CVE-2026-104633 A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenticated request

6.5 CVE-2026-105267 POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs

medium CVE-2026-97626 Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs

5.4 CVE-2026-89182 Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public

4.3 CVE-2026-105268 Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments

medium CVE-2026-101023 OAuth access tokens can be exchanged as refresh tokens

8.5 CVE-2026-96594 Stored XSS via Repository Media API

7.1 CVE-2026-86684 Push-mirror API checks local-path permission on the repository owner instead of the caller

Recent releases

Security advisories

Sources