Gitea 28.2.0 → 28.3.0

1 release · 0 breaking changes · 0 security fixes · 20 advisories fixed

0security0breaking0deprecated3feature37fix

Is 28.2.0 affected?

Vulnerabilities fixed by this upgrade

medium CVE-2026-119625 GET /{user}.rss / .atom leak private activity to a scope-confined API token (2nd incomplete-fix follow-up of GHSA-6cqf-375w-639g, user feed never got the scope-category check the repo feeds did)
6.5 CVE-2026-112887 Gitea Actions task tokens authenticate to the REST API with no token scope, enabling instance-wide private repository enumeration via GET /api/v1/user/repos
medium CVE-2026-116474 Actions token can spoof instance-signed commits by adding a GPG key
5.3 CVE-2026-119533 Public project boards disclose private pull request titles and repository names
6.5 CVE-2026-118504 API Issue Mutation Archive Restriction Bypass
medium CVE-2026-117677 Helm chart upload: unbounded gzip+tar metadata parse before the package-size quota gate (CWE-409/CWE-400 decompression amplification)
6.5 CVE-2026-117649 Cross-repository issue dependency and timeline read path serializes private issue title/body and attachments without the source repository access check (LoadDepIssueDetails/ToAPIIssue without ACL)
4.3 CVE-2026-118395 Deprecated POST /org/{org}/repos skips rejectPublicOnly; public-only tokens can create private repositories
4.3 CVE-2026-117646 Public-only tokens expose private repositories through profile and organization tabs
6.5 CVE-2026-116289 Public-only PAT scope bypass via Actions runner registration leaks private repository secrets
4.3 CVE-2026-114199 Contribution heatmap discloses private-repository contribution counts to public-only tokens (GetUserHeatmapData never reads ctx.PublicOnly while activity feeds do)
4.3 CVE-2026-119627 Gitea web profile and feed routes bypass public-only token scope for limited-visibility users
4.3 CVE-2026-118394 OIDC userinfo: the public-only token scope is not enforced when the token arrives as a query parameter (residual of CVE-2026-55982)
8.7 CVE-2026-113429 Stored XSS on the Gitea origin through the v3 artifact Content-Encoding header
8.1 CVE-2026-116296 Write collaborators can replace and destroy releases, milestones and labels on archived repositories (archived write-protection bypass)
8.1 CVE-2026-119441 Public-Only Token Bypass on Bulk Organization Repository Deletion
8.1 CVE-2026-117635 Public-only tokens bypass private-resource restrictions on the admin API
7.1 CVE-2026-117685 Public-only package tokens can access private OCI blobs
high CVE-2026-120263 Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username
8.1 CVE-2026-118386 Actions: fork workflow gets secrets and write token via review commit_id

Breaking changes

None in the release notes.

Security changes

None in the release notes.

Every release in between

28.3.0 Nov 1, 2026 Release notes ↗

featureImprove hover border of colored button groups (#39861) (#39899)

feature(webhook) Mention release assets in notifications (#39631) (#39912)

feature(project) Filter project milestones by linked issues (#39958) (#39984)

fix(pulls) Tolerate invalid stored review commit_id (#39849) (#39857)

fix(api) Skip label lookup in ListIssues when no labels filter given (#39890) (#39893)

fixPrevent system users from watching a repository (#39886) (#39895)

fixOff-by-one errors in code comment patches (#39887) (#39904)

fixUse clear error message when failed to parse git version (#39898) (#39903)

fix(packages) Reject newline-bearing rubygems dependency metadata (#39782) (#39900)

fixEnforce public-only token scope on more routes (#39690) (#39853)

fix(api) Return 4xx for invalid fork repository names (#39909) (#39919)

fix(lfs) Send the default branch as ref in batch download requests (#39891) (#39920)

fix(api) Keep milestone due date when it is omitted in edit request (#39869) (#39921)

fix(oauth2) Decode form-encoded client credentials in HTTP Basic auth (#39926) (#39931)

fix(issues) Keep one row per issue when sorting by exclusive label order (#39364) (#39928)

fix(api) Check unit read permission in issue sub-resource endpoints (#39885) (#39938)

fix(migrations) Use cursor pagination for GitHub issue migration too (#39888) (#39941)

fix(feed) Hide release notes in tags feed without releases access (#39944) (#39949)

fix(api) Adding issue labels by name attaches both the repo and the org label (#39873) (#39951)

fix(actions) Bound requested artifact retention (#39894) (#39946)

fix(actions) Drop untrusted Content-Encoding from v1 artifact uploads (#39855) (#39996)

fixGet valid UTF-8 for diff_hunk and composer readme (#39932) (#40000)

fix(diff) Load both blobs of renamed files for diff rendering (#39969) (#39992)

fix(migrations) Update gitea sdk to fix nil pointer panic (#39999)

fixFix OneDev migration with OneDev 16.8 and newer (#40017) (#40026)

fix(git) Default to the gc maintenance strategy (#40022) (#40029)

fixReplace null char with space for issue/comment content (#40014) (#40034)

fix(issue) Prevent redirect to external tracker when built-in tracker is enabled (#39997) (#40031)

fix(markup) Keep commit title emoji inside links (#39986) (#40032)

fix(repo) Use the viewed ref's editorconfig in file view, blame and editor (#39973) (#40019)

fix(deps) Update module golang.org/x/net to v0.62.0 [security] (#40050) (#40051)

fixSize mermaid iframe by the diagram's aspect ratio (#40046) (#40052)

fix(feed) Require code read access for the repo home branch feed (#39964) (#40067)

fixAdd missing access checks and size limits (#39942) (#40085)

fix(user) Answer the follow of a bot user with the profile card (#39980) (#40086)

fix(repo) Honor ALLOW_FORK_INTO_SAME_OWNER for organizations (#40025) (#40094)

fix(ui) Ignore code line anchors below 1, show JS errors in vite dev mode (#39432) (#40087)

fix(pull) Refuse review comments on locked pull requests (#39960) (#40084)

fix(api) Answer 409 when repository files already exist on disk (#40095) (#40098)

fix(mail) Preserve outer spacing in notification emails (#40104) (#40111)

+16 more items in the release notes