Gitea 28.0.0 → 28.3.0

Vulnerabilities fixed by this upgrade

• medium CVE-2026-119625 GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-category check the repo feeds did)
• 6.5 CVE-2026-112887 Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos
• medium CVE-2026-116474 Actions token can spoof instance-signed commits by adding a GPG key
• 5.3 CVE-2026-119533 Public project boards disclose private pull request titles and repository names
• 6.5 CVE-2026-118504 API Issue Mutation Archive Restriction Bypass
• medium CVE-2026-117677 Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)
• 6.5 CVE-2026-117649 Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDepIssueDetails/ToAPIIssue without ACL)
• 4.3 CVE-2026-118395 Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories
• 4.3 CVE-2026-117646 Public-only tokens expose private repositories through profile and organization tabs
• 6.5 CVE-2026-116289 Public-only PAT scope bypass via Actions runner registration leaks private repository secrets
• 4.3 CVE-2026-114199 Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds do)
• 4.3 CVE-2026-119627 Gitea web profile and feed routes bypass public-only token scope for limited-visibility users
• 4.3 CVE-2026-118394 OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)
• 8.7 CVE-2026-113429 Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header
• 8.1 CVE-2026-116296 Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)
• 8.1 CVE-2026-119441 Public-Only Token Bypass on Bulk Organization Repository Deletion
• 8.1 CVE-2026-117635 Public-only tokens bypass private-resource restrictions on the admin API
• 7.1 CVE-2026-117685 Public-only package tokens can access private OCI blobs
• high CVE-2026-120263 Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username
• 8.1 CVE-2026-118386 Actions: fork workflow gets secrets and write token via review commit_id
• low CVE-2026-107618 Cross-Site Request Forgery on `POST /{owner}/{repo}/topics`
• 3.5 CVE-2026-97204 DeleteLabel compares one untyped id against whichever namespace the label uses, letting a repo collaborator delete an ID-colliding organisation's labels
• 6.5 CVE-2026-110324 Private profile information leaks on POST request
• 6.5 CVE-2026-105964 Gitea Actions Artifact V4 API: unbounded request body read in parseProtobufBody enables memory-exhaustion DoS
• 4.3 CVE-2026-110311 Draft releases include attachment metadata from other repositories
• 5.3 CVE-2026-105661 Unauthenticated nil-pointer panic on /{username}/-/repositories for individual users
• 6.3 CVE-2026-110494 Gitea AddReleaseAttachments missing IssueID check allows issue attachment metadata exposure and deletion via releases
• 4.3 CVE-2026-107686 Locked issues and comments still accept reactions through the web UI
• 8.1 CVE-2026-104627 Cross-Session OpenID Credential Linking Enables Account Takeover
• 7.5 CVE-2026-109553 VerifyCert maps SSH certificate principals onto other users' SSH public keys
• 6.5 CVE-2026-104633 A migration source reporting max_response_items: 0 makes six paginated loops in the Gitea downloader never terminate, exhausting server memory from one authenticated request
• 6.5 CVE-2026-105267 POST /{owner}/{repo}/tags/delete requires only Code:Write but destroys Releases and their attachment blobs
• medium CVE-2026-97626 Web RSS/Atom Accept-header bypass leaks activity feeds of limited/private users and orgs
• 5.4 CVE-2026-89182 Gitea push-to-create ignores ForcePrivate server policy, allowing non-admin users to publish repositories as public
• 4.3 CVE-2026-105268 Issue-scoped attachment routes accept comment-scoped attachment ids, letting an issue opener delete or rename other users' comment attachments
• medium CVE-2026-101023 OAuth access tokens can be exchanged as refresh tokens
• 8.5 CVE-2026-96594 Stored XSS via Repository Media API
• 7.1 CVE-2026-86684 Push-mirror API checks local-path permission on the repository owner instead of the caller
• 8.1 CVE-2026-97208 Gitea push-mirror creation API does not enforce the site-wide DISABLE_NEW_PUSH policy

Breaking changes

None in the release notes.

Security changes

None in the release notes.

Every release in between