Gitea 28.3.0 Fixes Token Scope, OAuth2, and Actions Vulnerabilities
Tech GuruQuick Answer
Gitea 28.3.0 addresses 21 CVEs. Owners of self-hosted instances should compare their versions and enabled features with the project advisories, upgrade through the supported process, and test authentication, token restrictions, Actions, and outbound TLS.
Confirm Scope And Apply The Supported Remediation
What to do now: Identify self-hosted instances, running versions, build provenance, OAuth2 providers and account-linking settings, registration policy, personal access tokens, Actions runners, package stores, and private or archived repositories. Evaluate each advisory separately. For example, the OAuth2 issue requires automatic account linking and open registration; several token issues depend on the token owner’s existing privileges. A pre-28.3.0 version alone does not establish exposure to every issue. Back up the database, repositories, configuration, and package data, then upgrade to Gitea 28.3.0 using the project-supported deployment procedure. Coordinate service restart and runner integration checks; validate custom builds against the project’s Go 1.27.3 certificate-trust change. Verify the active version and test OAuth2 login, public-only token denial on private resources, Actions review workflows and artifacts, private issue and project visibility, archived-repository protections, package uploads, webhooks, mirrors, and outbound TLS. Review relevant authentication, API, runner-registration, and administrative logs where exposure is established.
Last verified: 2026-11-01 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Self-hosted Gitea servers, Actions, API tokens, OAuth2 account linking, package storage, and repository collaboration features |
|---|---|
| Advisory | Gitea 28.3.0 / GHSA-8r36-6j2c-3gmv / GHSA-9v6p-xpcp-7488 / GHSA-jr76-w9m3-3p68 / GHSA-qcgm-ggp8-22qc / GHSA-6h2f-c8jm-84hc / GHSA-mf6p-vqpw-3r7x / GHSA-37xv-m4w7-j2fh / GHSA-wxcq-p34j-7cjj / GHSA-p86q-78gw-8f3f / GHSA-r6mh-qg79-rqj2 / GHSA-8g99-g36h-5p2w / GHSA-32h8-5xqg-h466 / GHSA-q9gm-9c7q-c5hq / GHSA-x5v4-836g-f95x / GHSA-vmrc-8q2x-573x / GHSA-jh8p-x4ch-389q / GHSA-c45m-jm46-mwxg / GHSA-3fv3-hhmm-4x2q / GHSA-5j4v-rwqr-vpq7 / GHSA-8p3x-w464-4g6v |
| CVEs | CVE-2026-111943, CVE-2026-112887, CVE-2026-113429, CVE-2026-114199, CVE-2026-116289, CVE-2026-116296, CVE-2026-116474, CVE-2026-117635, CVE-2026-117646, CVE-2026-117649, CVE-2026-117677, CVE-2026-117685, CVE-2026-118386, CVE-2026-118394, CVE-2026-118395, CVE-2026-118504, CVE-2026-119441, CVE-2026-119533, CVE-2026-119625, CVE-2026-119627, CVE-2026-120263 |
| Authoritative release date | 2026-11-01 09:55:07 UTC (Gitea 28.3.0 release) |
| Authority revision date | 2026-11-01 09:55:07 UTC (release metadata; no later revision reported at review) |
| Affected versions | The 20 Gitea-specific advisories list affected releases through 28.2.0, with issue-specific lower bounds and permission or configuration prerequisites shown below. The separate Go certificate-trust change concerns the runtime used for outbound TLS. |
| Fixed version | Gitea 28.3.0; official release binaries are built with Go 1.27.3 |
| CVSS base score | 4.3–8.7 (CVSS v3.1, where provided) |
| CVSS severity | Medium to High |
| Exploitation status | Gitea does not state that these issues have been maliciously exploited.; no exploitation claim is inferred. |
Issue-Specific Version And Score Evidence
| CVE-2026-112887 | <= 28.2.0; fixed in 28.3.0. 6.5 (CVSS v3.1); Medium. |
|---|---|
| CVE-2026-113429 | <= 28.2.0; fixed in 28.3.0. 8.7 (CVSS v3.1); High. |
| CVE-2026-114199 | <= 28.2.0; fixed in 28.3.0. 4.3 (CVSS v3.1); Medium. |
| CVE-2026-116289 | <= 28.2.0; fixed in 28.3.0. 6.5 (CVSS v3.1); Medium. |
| CVE-2026-116296 | <= 28.2.0; fixed in 28.3.0. 8.1 (CVSS v3.1); High. |
| CVE-2026-116474 | >= 1.19.0, <= 28.2.0; fixed in 28.3.0. Not provided by the authority; Medium. |
| CVE-2026-117635 | <= 28.2.0; fixed in 28.3.0. 8.1 (CVSS v3.1); High. |
| CVE-2026-117646 | <= 28.2.0; fixed in 28.3.0. 4.3 (CVSS v3.1); Medium. |
| CVE-2026-117649 | <= 28.2.0; fixed in 28.3.0. 6.5 (CVSS v3.1); Medium. |
| CVE-2026-117677 | <= 28.2.0; fixed in 28.3.0. Not provided by the authority; Medium. |
| CVE-2026-117685 | <= 28.2.0; fixed in 28.3.0. 7.1 (CVSS v3.1); High. |
| CVE-2026-118386 | >= 1.19.0, <= 28.2.0; fixed in 28.3.0. 8.1 (CVSS v3.1); High. |
| CVE-2026-118394 | >= 1.23.0, <= 28.2.0; fixed in 28.3.0. 4.3 (CVSS v3.1); Medium. |
| CVE-2026-118395 | <= 28.2.0; fixed in 28.3.0. 4.3 (CVSS v3.1); Medium. |
| CVE-2026-118504 | <= 28.2.0; fixed in 28.3.0. 6.5 (CVSS v3.1); Medium. |
| CVE-2026-119441 | >= 1.27.0, <= 28.2.0; fixed in 28.3.0. 8.1 (CVSS v3.1); High. |
| CVE-2026-119533 | <= 28.2.0; fixed in 28.3.0. 5.3 (CVSS v3.1); Medium. |
| CVE-2026-119625 | <= 28.2.0; fixed in 28.3.0. Not provided by the authority; Medium. |
| CVE-2026-119627 | <= 28.2.0; fixed in 28.3.0. 4.3 (CVSS v3.1); Medium. |
| CVE-2026-120263 | <= 28.2.0; fixed in 28.3.0. Not provided by the authority; High. |
| CVE-2026-111943 | Release binaries use Go 1.27.3 for revised outbound certificate trust. CVSS score and severity: Not provided by the authority in the Gitea release bulletin. |
What Changed
Gitea released 28.3.0 with 20 project security fixes and a Go certificate-trust update, covering 21 CVEs. The fixes address OAuth2 account takeover under automatic linking and open registration, Actions workflow trust, public-only token restrictions, private-data disclosure, archived-repository changes, artifact XSS, and Helm upload resource exhaustion. The new binaries also change outbound certificate trust.
What To Validate Now
- Inventory. Identify self-hosted instances, running versions, build provenance, OAuth2 providers and account-linking settings, registration policy, personal access tokens, Actions runners, package stores, and private or archived repositories.
- Establish applicability. Evaluate each advisory separately. For example, the OAuth2 issue requires automatic account linking and open registration; several token issues depend on the token owner’s existing privileges. A pre-28.3.0 version alone does not establish exposure to every issue.
- Remediate. Back up the database, repositories, configuration, and package data, then upgrade to Gitea 28.3.0 using the project-supported deployment procedure. Coordinate service restart and runner integration checks; validate custom builds against the project’s Go 1.27.3 certificate-trust change.
- Validate. Verify the active version and test OAuth2 login, public-only token denial on private resources, Actions review workflows and artifacts, private issue and project visibility, archived-repository protections, package uploads, webhooks, mirrors, and outbound TLS. Review relevant authentication, API, runner-registration, and administrative logs where exposure is established.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
The project advises upgrading promptly. A score is not evidence of compromise. Sixteen Gitea advisories provide CVSS v3.1 base scores; four Gitea advisories and the release bulletin’s certificate item do not provide a numeric score. Token and feed restrictions may change integration behavior, and certificate distrust can affect OAuth2 providers, webhooks, mirrors, and migrations. Retain a tested recovery plan and assess suspicious activity separately from the upgrade.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Gitea 28.3.0 release metadata and downloads
- Gitea 28.3.0
- GHSA-8r36-6j2c-3gmv
- GHSA-9v6p-xpcp-7488
- GHSA-jr76-w9m3-3p68
- GHSA-qcgm-ggp8-22qc
- GHSA-6h2f-c8jm-84hc
- GHSA-mf6p-vqpw-3r7x
- GHSA-37xv-m4w7-j2fh
- GHSA-wxcq-p34j-7cjj
- GHSA-p86q-78gw-8f3f
- GHSA-r6mh-qg79-rqj2
- GHSA-8g99-g36h-5p2w
- GHSA-32h8-5xqg-h466
- GHSA-q9gm-9c7q-c5hq
- GHSA-x5v4-836g-f95x
- GHSA-vmrc-8q2x-573x
- GHSA-jh8p-x4ch-389q
- GHSA-c45m-jm46-mwxg
- GHSA-3fv3-hhmm-4x2q
- GHSA-5j4v-rwqr-vpq7
- GHSA-8p3x-w464-4g6v
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
