# Gitea 28.3 fixes OAuth account takeover and Actions secret-exposure flaws across 20 security issues The November 1 Gitea 28.3.0 maintenance release patches 20 reported security issues, including a conditional OAuth account takeover and a pull-request review workflow trust-boundary failure that could expose repository secrets. Self-hosted Gitea operators should upgrade to 28.3.0 and audit OAuth auto-linking, Actions runner access and previously issued token scopes; not every vulnerability affects every deployment. - Status: Active - Published: 2026-11-02T06:12:58+13:00 - Updated: 2026-11-02T06:12:58+13:00 - Categories: Web Development, Cloud & Infrastructure, Deployment & DevOps, Developer Tools - Tags: access tokens, CI/CD, Gitea, OAuth, security, self-hosting - Canonical HTML: https://beyondthe.news/dossiers/gitea-28-3-oauth-account-takeover-actions-secrets-token-scopes-security ## What changed On November 1, 2026, Gitea published 28.3.0 with 20 enumerated CVEs and numerous nonsecurity fixes. Its upstream notes describe a high-severity account-takeover bug in OAuth2 auto-linking when ACCOUNT_LINKING=auto and registration is open, a pull_request_review Actions trust-boundary failure that can run attacker-controlled workflow code with a repository's secrets and write token, and multiple public-only token scope bypasses exposing private information or permitting privileged actions. Additional fixes address archived-repository API mutations, stored XSS in legacy Actions artifacts and a Helm-chart decompression denial of service. Maintainers recommend prompt upgrade; release binaries also move to Go 1.27.3 to address certificate-chain trust concerns. ## Why it matters Self-hosted Git forges are often the control plane for code, CI runners, deployment credentials and private repositories. These bugs cross distinct trust boundaries: an OAuth form field can be treated as an identity claim, a review's supplied commit can be treated as trusted workflow code, and an API token's public-only scope can be ignored. An administrator or read-only collaborator may be able to trigger consequences much broader than their intended permissions. The release provides an actionable patch, but operators must check configuration-specific preconditions and consider whether existing sessions, OAuth links, secrets or runner tokens warrant investigation. ## OAuth auto-linking could bind an attacker's identity to an existing account CVE-2026-120263 affects deployments configured with non-default ACCOUNT_LINKING=auto and open registration. The link-account signup path accepted attacker-controlled username/email form values as a lookup for an existing Gitea account instead of relying on the OAuth provider's asserted identity. The upstream researcher demonstrated account takeover, including administrator accounts, and a WebAuthn-only two-factor bypass in the affected flow. The default ACCOUNT_LINKING=login is not affected by this attack path. Patch 28.3.0 and audit external account links where auto-linking was enabled. ## Review-triggered Actions could run untrusted code with secrets CVE-2026-118386 allows a user with repository read access to submit a pull-request review naming their own commit_id on a same-repository pull request. Before the fix, Gitea could read workflow files from that attacker-controlled commit while deciding runner approval, secret access and GITEA_TOKEN write permissions based on the trusted pull request. The advisory documents a reproducer receiving a job with secrets and a write-capable token; it did not run a real runner in that reproducer. The attack requires an account, a serving runner and a qualifying pull request; disabling forks alone does not remove the path. Version 28.3.0 runs review-triggered workflows against the pull-request head. ## Public-only token restrictions were inconsistently enforced Several fixes address token-scope enforcement. Depending on the token holder's underlying role, affected endpoints could list private repositories or user data, create administrator accounts, register organisation runners able to receive private jobs and secrets, delete private organisation repositories or mount private OCI blobs into public packages. This is not a claim that an anonymous internet user could perform all these actions; underlying administrator or owner privileges and token capabilities matter. Administrators should examine their token inventory and access logs after patching. ## Other security fixes and operational follow-up The release also fixes stored XSS in legacy Actions artifact downloads, archived-repository API writes, private issue and pull-request metadata exposure, and a compressed Helm chart upload resource-exhaustion issue. Gitea reports 60 merged PRs, improvements to Actions job scheduling, issue and pull-request performance, migration behaviour and SQLite indexing. Operators should plan a backup, upgrade to 28.3.0 or a confirmed vendor backport, test OAuth and CI workflows, review suspicious login links and Actions executions, and rotate secrets if evidence of exposure is found. ## Key details - Release date: November 1, 2026; Gitea version 28.3.0. - Upstream release lists 20 CVEs; severity and prerequisites vary. - CVE-2026-120263: OAuth ACCOUNT_LINKING=auto account takeover under specific configuration. - CVE-2026-118386: pull_request_review commit_id workflow could receive secrets and write token. - Multiple public-only token scope bypasses affect private data and privileged operations. - Other fixes cover stored XSS, archived repository writes, metadata leaks and resource exhaustion. - No broad in-the-wild exploitation was established in the inspected sources. ## Builder takeaways - Upgrade self-hosted Gitea to 28.3.0 promptly and verify deployment-specific package/backport versions. - If OAuth ACCOUNT_LINKING=auto was enabled, review linked external identities and login history; do not assume MFA alone blocked this bug. - Inspect Actions runner executions and sensitive repository/organisation secrets where untrusted users could review pull requests. - Audit public-only and Actions tokens, API access and repository visibility; revoke/rotate on evidence of misuse. - Test workflows, packages and OAuth after the security upgrade. ## What to watch - Whether Gitea or downstream distributions publish further backports and configuration guidance. - Any verified exploitation or forensic indicators for the OAuth and Actions bugs. - Regression reports affecting Actions, OAuth2 or token-scoped API integrations. ## Uncertainties - The release announcement does not establish in-the-wild exploitation or an affected-instance count. - The OAuth account-takeover flaw requires non-default account auto-linking and open registration; Actions flaw has runner and pull-request prerequisites. - Exact impact varies by API route, token owner permissions and enabled Gitea features. ## Sources - [Gitea 28.3.0 is released](https://blog.gitea.com/release-of-28.3.0/) — Gitea · primary release notes · 2026-11-01T00:00:00+13:00. Maintainer's CVE inventory, mitigations and nonsecurity fixes. - [Account Takeover via OAuth2 Auto-Linking with Attacker-Controlled Username](https://github.com/go-gitea/gitea/security/advisories/GHSA-8p3x-w464-4g6v) — Gitea GitHub Security Advisories / Doyensec · primary coordinated vulnerability advisory · 2026-11-01T00:00:00+13:00. Researcher reproduction, nondefault configuration, identity trust boundary and WebAuthn limitations. - [Actions: fork workflow gets secrets and write token via review commit_id](https://github.com/go-gitea/gitea/security/advisories/GHSA-32h8-5xqg-h466) — Gitea GitHub Security Advisories · primary security advisory · 2026-11-01T00:00:00+13:00. Reproduction, prerequisite and impact details for untrusted workflow execution.