Gitea 1.27.3 → 28.3.0

Vulnerabilities fixed by this upgrade

• medium CVE-2026-119625 GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-category check the repo feeds did)
• 6.5 CVE-2026-112887 Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos
• medium CVE-2026-116474 Actions token can spoof instance-signed commits by adding a GPG key
• 5.3 CVE-2026-119533 Public project boards disclose private pull request titles and repository names
• 6.5 CVE-2026-118504 API Issue Mutation Archive Restriction Bypass
• medium CVE-2026-117677 Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)
• 6.5 CVE-2026-117649 Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDepIssueDetails/ToAPIIssue without ACL)
• 4.3 CVE-2026-118395 Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories
• 4.3 CVE-2026-117646 Public-only tokens expose private repositories through profile and organization tabs
• 6.5 CVE-2026-116289 Public-only PAT scope bypass via Actions runner registration leaks private repository secrets
• 4.3 CVE-2026-114199 Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds do)
• 4.3 CVE-2026-119627 Gitea web profile and feed routes bypass public-only token scope for limited-visibility users
• 4.3 CVE-2026-118394 OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)
• 8.7 CVE-2026-113429 Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header
• 8.1 CVE-2026-116296 Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)
• 8.1 CVE-2026-119441 Public-Only Token Bypass on Bulk Organization Repository Deletion
• 8.1 CVE-2026-117635 Public-only tokens bypass private-resource restrictions on the admin API
• 7.1 CVE-2026-117685 Public-only package tokens can access private OCI blobs
• high CVE-2026-120263 Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username
• 8.1 CVE-2026-118386 Actions: fork workflow gets secrets and write token via review commit_id
• low CVE-2026-107618 Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`
• 3.5 CVE-2026-97204 DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels
• 6.5 CVE-2026-110324 Private profile information leaks on POST request
• 6.5 CVE-2026-105964 Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS
• 4.3 CVE-2026-110311 Draft releases include attachment metadata from other repositories
• 5.3 CVE-2026-105661 Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users
• 6.3 CVE-2026-110494 Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases
• 4.3 CVE-2026-107686 Locked issues and comments still accept reactions through the web UI
• 8.1 CVE-2026-104627 Cross-Session OpenID Credential Linking Enables Account Takeover
• 7.5 CVE-2026-109553 VerifyCert maps SSH certificate principals onto other users' SSH public keys
• 6.5 CVE-2026-104633 A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenticated request
• 6.5 CVE-2026-105267 POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs
• medium CVE-2026-97626 Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs
• 5.4 CVE-2026-89182 Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public
• 4.3 CVE-2026-105268 Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments
• medium CVE-2026-101023 OAuth access tokens can be exchanged as refresh tokens
• 8.5 CVE-2026-96594 Stored XSS via Repository Media API
• 7.1 CVE-2026-86684 Push-mirror API checks local-path permission on the repository owner instead of the caller
• 8.1 CVE-2026-97208 Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy
• medium CVE-2026-95112 Algorithmic Complexity DoS in Issue Reference Parsing
• medium CVE-2026-103504 API team demotion does not reset unit permissions
• medium CVE-2026-79960 Deploy keys impersonate the repository owner in the hook pipeline
• 4.3 CVE-2026-104636 Raw Git redirect SSRF bypass in push mirrors, WikiRemoteURL, and PR-head fetches
• 4.3 CVE-2026-96400 Migration SSRF policy regression: ALLOWED_DOMAINS permits reserved addresses despite ALLOW_LOCALNETWORKS=false
• 4.3 CVE-2026-96589 Incorrect Authorization in Repository Transfer Allows Persistent Unauthorized Read Access
• 8.1 CVE-2026-96404 Installer Re-run Against an Already-Populated Database Grants an Authenticated Session for an Existing Admin Account Without Password Verification
• 7.1 CVE-2026-96399 Uncaught Exception and Out-of-bounds Read results in Gitea crash
• 8.5 CVE-2026-89430 Gitea Push Mirror Host Policy Bypass Enables SSRF and Forced Writes to Internal Git Repositories
• 8.5 CVE-2026-101029 Migration / pull-mirror SSRF, egress allow-list bypass via multi-answer DNS - 3 findings
• 7.7 CVE-2026-101027 SSRF via DNS rebinding: MatchHostOrIP short-circuits IP check when hostname matches ALLOWED_DOMAINS
• high CVE-2026-70357 Migration SSRF via DNS Rebinding — TOCTOU Between DNS Validation and Git Connection
• 9.0 CVE-2026-95106 Duplicate tree-entry name: Gitea renders the benign blob while checkout and CI run the malicious one
• 9.0 CVE-2026-103667 Stored XSS in Gitea container registry via unvalidated blob Content-Type (mediaType injection)
• 9.1 CVE-2026-103059 Built-in SSH server auth bypass via case-insensitive LIKE key lookup
• 8.7 CVE-2026-94205 Gitea Actions: fork pull request approval bypass via maintainer-triggered pull_request sub-events (ifNeedApprovalWith keys on the event actor, not the pull request author)
• medium CVE-2026-96580 Uncontrolled resource consumption — unapproved fork-PR workflow with a large static strategy.matrix exhausts server memory at run-creation
• high CVE-2026-103670 Unapproved fork PR cancels trusted in-progress runs via run-level concurrency
• 9.0 CVE-2026-104626 Cancelled fork-PR Actions jobs are revived by later approval
• 9.0 CVE-2026-104632 Untrusted first-time fork PR achieves self-hosted Actions runner RCE without approval via cancel-then-rerun
• 9.9 CVE-2026-73802 Sandbox Escape to Host RCE: Gitea act_runner Privileged Mode Bypass via Unsanitized container.options

Breaking changes

• breaking BREAKING in 28.0.0
• breaking Fix(git)!: route Git network operations through an internal proxy and update egress settings () in 28.0.0
• breaking Feat(actions)!: add RUN_RETENTION_DAYS to delete old action runs () in 28.0.0

Security changes

• security Fixes CVE-2026-57894: Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository Exfiltration in 28.0.0
• security SECURITY in 28.0.0
• security Fix(deps): update module golang.org/x/image to v0.45.0 [security] () in 28.0.0
• security Fix(deps): update module golang.org/x/mod to v0.40.0 [security] () in 28.0.0
• security Fix(deps): update dependency mermaid to v11.16.1 [security] () in 28.0.0
• security Fix(deps): update module github.com/getkin/kin-openapi to v0.144.0 [security] () in 28.0.0
• security Fix(deps): update dependency js-yaml to v5.2.2 [security] () in 28.0.0
• security Fix(deps): update module google.golang.org/grpc to v1.82.1 [security] () in 28.0.0

Deprecations

• deprecated Enhance(packages/npm): expand version metadata and support npm deprecate () in 28.0.0

Every release in between