What changed
On November 1, 2026, Gitea published 28.3.0 with 20 enumerated CVEs and numerous nonsecurity fixes. Its upstream notes describe a high-severity account-takeover bug in OAuth2 auto-linking when ACCOUNT_LINKING=auto and registration is open, a pull_request_review Actions trust-boundary failure that can run attacker-controlled workflow code with a repository's secrets and write token, and multiple public-only token scope bypasses exposing private information or permitting privileged actions. Additional fixes address archived-repository API mutations, stored XSS in legacy Actions artifacts and a Helm-chart decompression denial of service. Maintainers recommend prompt upgrade; release binaries also move to Go 1.27.3 to address certificate-chain trust concerns.
Why it matters
Self-hosted Git forges are often the control plane for code, CI runners, deployment credentials and private repositories. These bugs cross distinct trust boundaries: an OAuth form field can be treated as an identity claim, a review's supplied commit can be treated as trusted workflow code, and an API token's public-only scope can be ignored. An administrator or read-only collaborator may be able to trigger consequences much broader than their intended permissions. The release provides an actionable patch, but operators must check configuration-specific preconditions and consider whether existing sessions, OAuth links, secrets or runner tokens warrant investigation.
OAuth auto-linking could bind an attacker's identity to an existing account
CVE-2026-120263 affects deployments configured with non-default ACCOUNT_LINKING=auto and open registration. The link-account signup path accepted attacker-controlled username/email form values as a lookup for an existing Gitea account instead of relying on the OAuth provider's asserted identity. The upstream researcher demonstrated account takeover, including administrator accounts, and a WebAuthn-only two-factor bypass in the affected flow. The default ACCOUNT_LINKING=login is not affected by this attack path. Patch 28.3.0 and audit external account links where auto-linking was enabled.
Review-triggered Actions could run untrusted code with secrets
CVE-2026-118386 allows a user with repository read access to submit a pull-request review naming their own commit_id on a same-repository pull request. Before the fix, Gitea could read workflow files from that attacker-controlled commit while deciding runner approval, secret access and GITEA_TOKEN write permissions based on the trusted pull request. The advisory documents a reproducer receiving a job with secrets and a write-capable token; it did not run a real runner in that reproducer. The attack requires an account, a serving runner and a qualifying pull request; disabling forks alone does not remove the path. Version 28.3.0 runs review-triggered workflows against the pull-request head.
Public-only token restrictions were inconsistently enforced
Several fixes address token-scope enforcement. Depending on the token holder's underlying role, affected endpoints could list private repositories or user data, create administrator accounts, register organisation runners able to receive private jobs and secrets, delete private organisation repositories or mount private OCI blobs into public packages. This is not a claim that an anonymous internet user could perform all these actions; underlying administrator or owner privileges and token capabilities matter. Administrators should examine their token inventory and access logs after patching.
Other security fixes and operational follow-up
The release also fixes stored XSS in legacy Actions artifact downloads, archived-repository API writes, private issue and pull-request metadata exposure, and a compressed Helm chart upload resource-exhaustion issue. Gitea reports 60 merged PRs, improvements to Actions job scheduling, issue and pull-request performance, migration behaviour and SQLite indexing. Operators should plan a backup, upgrade to 28.3.0 or a confirmed vendor backport, test OAuth and CI workflows, review suspicious login links and Actions executions, and rotate secrets if evidence of exposure is found.