Gitea 28.2.0 Addresses 12 Security Vulnerabilities
Tech GuruQuick Answer
Gitea 28.2.0 addresses 12 maintainer security advisories, with official CVSS v3.1 scores ranging from 3.5 to 8.1 where supplied. Inventory self-hosted instances, match each advisory's affected range and configuration, upgrade the current 28.x stream to 28.2.0 or later, validate authentication and repository workflows, and retain evidence.
Upgrade Gitea And Validate Security-Sensitive Workflows
What to do now: Inventory Gitea versions and configurations, match the 12 advisories to enabled features and permissions, upgrade the current 28.x stream to 28.2.0 or later, validate identity, SSH, Actions, profile, issue, and repository workflows, review relevant logs, and preserve evidence.
Last verified: 2026-10-19 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Gitea releases through 28.1.0, with issue-specific affected ranges and configurations |
|---|---|
| Advisory | Gitea 28.2.0 / GHSA-mf69-7pqq-86vx / GHSA-vcp6-2qc6-gvq3 / GHSA-c3cr-qq9g-666c / GHSA-6f9g-7jgm-m5ph / GHSA-4jmf-h2cm-hg7w / GHSA-wx44-9m3m-rjqx / GHSA-96gv-2xc4-4hxj / GHSA-8j56-f865-gqq2 / GHSA-xmfc-hqq8-33wh / GHSA-cwq7-782w-pxcc / GHSA-fxq4-gr55-7x5g / GHSA-xvfh-qwmh-f92w |
| CVEs | CVE-2026-104627, CVE-2026-105661, CVE-2026-105964, CVE-2026-107618, CVE-2026-107686, CVE-2026-109553, CVE-2026-109844, CVE-2026-110311, CVE-2026-110324, CVE-2026-110494, CVE-2026-97204, CVE-2026-97859 |
| Authoritative release date | 2026-10-18 18:25:03 UTC |
| Authority revision date | 2026-10-18 18:57:41 UTC |
| Affected versions | Issue-specific Gitea ranges documented by the 12 maintainer advisories; several findings require particular permissions or configurations, and three were fixed in earlier releases but disclosed with 28.2.0. |
| Fixed version | Gitea 28.2.0 or later on the current 28.x stream; follow each advisory for older supported stream fixes |
| CVSS base score | 3.5 to 8.1 (CVSS v3.1); two advisories do not provide a base score |
| CVSS severity | Low to High |
| Exploitation status | Not stated by Gitea; no exploitation claim is inferred. |
What Changed
The maintainer release includes security fixes spanning authentication, authorization, information disclosure, request handling, and repository interactions.
What To Validate Now
- Inventory. Identify self-hosted Gitea instances, exact releases, authentication and OpenID settings, trusted SSH certificate authorities, Actions runners, private repositories and profiles, repository permissions, owners, backups, and integrations.
- Establish applicability. Evaluate each maintainer advisory separately because affected ranges and prerequisites differ. Do not infer that every instance is exposed to all 12 issues merely because it runs a pre-28.2.0 release.
- Remediate. Upgrade the current 28.x stream to Gitea 28.2.0 or later through the supported project process. For older supported streams, use the fixed version stated by the corresponding advisory rather than assuming one common backport.
- Validate. Confirm the running release, test OpenID linking and login, SSH certificate authentication, Actions artifacts, locked-issue controls, private profile and repository visibility, releases and attachments, backups, integrations, and rollback; review authentication, API, SSH, Actions, and administrative logs.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
Three disclosed issues were fixed in earlier releases and two maintainer advisories do not publish a CVSS base score. Preserve configuration and evidence before upgrading, test clustered or integrated deployments, and do not infer exploitation from severity or public disclosure.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
- Gitea 28.2.0
- GHSA-mf69-7pqq-86vx
- GHSA-vcp6-2qc6-gvq3
- GHSA-c3cr-qq9g-666c
- GHSA-6f9g-7jgm-m5ph
- GHSA-4jmf-h2cm-hg7w
- GHSA-wx44-9m3m-rjqx
- GHSA-96gv-2xc4-4hxj
- GHSA-8j56-f865-gqq2
- GHSA-xmfc-hqq8-33wh
- GHSA-cwq7-782w-pxcc
- GHSA-fxq4-gr55-7x5g
- GHSA-xvfh-qwmh-f92w
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
