Self-hosted Gitea administrators should upgrade to version 28.3.0, released November 1, after the project fixed multiple security flaws involving token scopes, OAuth account linking and CI workflows.
The maintainers say the release also includes bug fixes and performance improvements and recommend that all users upgrade as soon as possible. The official release notes describe the security changes.
Several vulnerabilities could expose private repositories or let tokens perform actions beyond their intended permissions. CVE-2026-117635 allowed a public-only token belonging to a site administrator to use admin API routes to list user email addresses, create private organizations and runner registration tokens, or create new administrators. CVE-2026-119441 could let a public-only token owned by an organization administrator delete the organization’s repositories, including private ones. CVE-2026-112887 also allowed an Actions job token to enumerate private repositories across a Gitea instance.
The update also fixes a workflow issue tracked as CVE-2026-118386. A user with read access could submit a pull-request review referencing their own commit and trigger a review workflow without approval, potentially exposing repository secrets and a write-capable token. CVE-2026-113429 addresses stored cross-site scripting through legacy Actions artifact uploads. Another flaw, CVE-2026-120263, could enable account takeover when automatic OAuth account linking and open registration were both enabled; the project’s advisory explains the configuration-dependent issue.
These findings add to recent weaknesses in developer infrastructure, including a critical GitLab CI/CD vulnerability and a Jpom authentication bypass. Self-hosted code platforms can hold source code, build credentials and deployment secrets, making authorization bugs especially consequential.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
