Upgrade Gitea to 28.3.0, released on 1 November 2026. The release notes list 21 security fixes and say “We strongly recommend that all users upgrade as soon as possible.” Every GitHub advisory we opened names 28.3.0 as the only patched version, and the affected range runs up to and including 28.2.0.
Most of the fixes are about token scopes, mainly the public-only token restriction. Three matter beyond that: an account takeover, an Actions secrets leak and a stored cross-site scripting flaw. This guide ranks them, shows who is exposed and lists what to check after the upgrade.
Which Three Gitea Fixes Should You Read First?
CVE-2026-120263 is the account takeover. With ACCOUNT_LINKING set to auto and open registration, the link-account sign-up form accepted the user name or email of an existing account. Gitea then linked it to the attacker’s OAuth2 identity and signed them in without a password.
The advisory is rated High by GitHub but carries no CVSS score. It says the link survives logouts and password changes, and that administrator accounts are reachable. The default is ACCOUNT_LINKING = login, so, per the release notes, the flaw applies to instances that switched to auto and allow self-registration.
CVE-2026-118386 (CVSS 3.1 8.1) targets Actions. A user with read access could submit a pull request review that names their own commit. The pull_request_review workflow then ran from that commit without approval, with the repository’s secrets and a token that can write to it.
The advisory says disabling forks does not help, because the attacker only needs read access. It lists three conditions: an account, a runner serving the repository and one pull request whose head branch is in the same repository. The fix runs review-triggered workflows on the pull request head.
CVE-2026-113429 (8.7) is stored cross-site scripting. The legacy Actions artifact upload saved a Content-Encoding header and served it back as the download’s content type. Anyone who can run a job can upload such a file, and a victim who opens the direct download link runs the attacker’s script.
The advisory says that for an administrator this means control of the instance. The report tested only Chromium, and the run page preview is sandboxed. See our entry on cross-site scripting for the attack class.
What Could a Public-Only Token Do Before 28.3.0?
A public-only token is meant to reach public resources only, which makes it a natural choice for bots and CI jobs (our view). Four fixes show the limit did not hold. These need a stolen or leaked token whose owner has the right role.
- CVE-2026-119441 (8.1): the token of an organization owner could delete all repositories of a public organization, private ones included. The route exists from 1.27.0.
- CVE-2026-117635 (8.1): a site administrator’s token could list every user’s email address and create new administrators through the admin API.
- CVE-2026-116289 (6.5): an owner’s token could create an organization runner registration token. A runner registered with it received jobs and secrets from private repositories.
- CVE-2026-117685 (7.1): a package token could mount a private container blob into a public package and read it.
Separately, CVE-2026-116296 (8.1) let users with write access change releases, milestones and labels of archived repositories. The first flaw above is an account takeover; these are token-scope bypasses.
All Gitea 28.3.0 Advisories at a Glance
The table lists the 20 CVE records that appeared on 1 November, with the CVSS 3.1 score from each GitHub advisory. The advisories give no CVSS 4.0 score, and four carry only a severity label. The release notes add CVE-2026-111943, a Go 1.27.3 build change that stops trusting certain intermediate certificates.
| CVE | What it allowed | CVSS 3.1 |
|---|---|---|
| CVE-2026-120263. | OAuth2 auto-linking takeover through the sign-up form. | Not scored (High). |
| CVE-2026-113429. | Stored XSS through an Actions artifact header. | 8.7. |
| CVE-2026-118386. | Review-triggered workflow gets secrets and a write token. | 8.1. |
| CVE-2026-117635. | Admin API ignores the public-only restriction. | 8.1. |
| CVE-2026-119441. | Bulk deletion of an organization’s repositories. | 8.1. |
| CVE-2026-116296. | Releases, milestones and labels of archived repositories editable. | 8.1. |
| CVE-2026-117685. | Private OCI blob mounted into a public package. | 7.1. |
| CVE-2026-116289. | Organization runner registration with a public-only token. | 6.5. |
| CVE-2026-112887. | Job token lists private repositories. | 6.5. |
| CVE-2026-117649. | Private issues shown in dependency timelines. | 6.5. |
| CVE-2026-118504. | Archived repositories still accept issue changes by API. | 6.5. |
| CVE-2026-119533. | Project boards show private pull request details. | 5.3. |
| CVE-2026-117646. | Profile and organization pages list private repositories. | 4.3. |
| CVE-2026-118394. | OIDC userinfo lists private organizations and teams. | 4.3. |
| CVE-2026-118395. | Deprecated route creates private repositories. | 4.3. |
| CVE-2026-114199. | Contribution heatmap counts private activity. | 4.3. |
| CVE-2026-119627. | Limited-visibility profiles and feeds shown. | 4.3. |
| CVE-2026-119625. | User and organization feeds ignore token scope. | Not scored (Medium). |
| CVE-2026-116474. | Job token adds a GPG key to the Actions system user. | Not scored (Medium). |
| CVE-2026-117677. | Helm chart upload can exhaust the server. | Not scored (Medium). |
- CISA KEVNot seenNone of the 21 CVEs is in catalog version 2026.10.301 Nov
- GitHubYesOne public repository created on 1 November describes CVE-2026-116296 and names 28.2.1 as the fix; the advisory names 28.3.01 Nov
- Brandefense BlackholeYes27 Telegram posts on 1 November from two automated CVE-feed channels repeat the CVE records1 Nov
- Earlier Gitea flawYesCISA KEV lists CVE-2026-60004, a different Gitea code injection flaw, added on 25 August 202625 Aug
The repository README is a third-party write-up with a different fix version. Use the Gitea advisory, not that page, to pick your target version.
Six Steps From Version Check to Token Audit
- Find your versionRun gitea –version on each server. Anything up to and including 28.2.0 is in the advisories’ range; a few start at 1.19.0, 1.23.0 or 1.27.0. Treat internet-facing instances first.
- Read the 28.0.0 notes if you are on 1.xThe 28.0.0 release post lists breaking changes. They include Git 2.25 or newer, new egress rules, completed Actions runs deleted after 400 days unless RUN_RETENTION_DAYS = 0, and self-registration off unless DISABLE_REGISTRATION = false. Proxies must also forward WebSocket headers.
- Check account linking todayOpen app.ini and read ACCOUNT_LINKING under [oauth2_client], and DISABLE_REGISTRATION under [service]. If linking is auto and registration is open, set linking back to login until you upgrade, per the config cheat sheet.
- Review administrators and linked loginsAfter upgrading, list site administrators and look for accounts you did not create. The advisory describes the takeover link as persistent, and the release notes do not say whether links made earlier are removed, so check external logins on administrator accounts.
- Audit tokensAsk owners and administrators to open Settings, then Applications, and delete tokens they no longer use. Replace public-only tokens held by CI, bots or integrations, and rotate any that were shared outside the team.
- Rotate what Actions could reachWhere untrusted users have read access and workflows use pull_request_review, rotate repository and owner secrets. Delete unknown organization runners and regenerate runner registration tokens.
Steps 3 to 6 are our advice, not vendor instructions. If you cannot upgrade at once, restrict who can register and who can reach Actions. Our GitLab critical flaw guide covers a similar self-hosted Git case.
A self-hosted Git server is part of your supply chain, so give its tokens only the access they need (least privilege). Our External Attack Surface Management service scans an organization’s internet-facing assets within minutes, which helps find Gitea servers you forgot.