Gitea, the popular open-source, self-hosted Git service, has released version 28.2, the second maintenance update in the 28.x series, addressing multiple security vulnerabilities and bug fixes affecting Actions, PRs, authentication, and package management.
The developers disclosed 12 vulnerabilities, nine fixed in version 28.2. The remaining three were addressed in earlier releases but are now publicly disclosed.
Among the most serious issues is CVE-2026-109553, an SSH authentication flaw involving improper validation of certificate principals. Under certain configurations, an attacker could authenticate as another user by exploiting how Gitea matched certificate principals against stored public keys.
Another important fix addresses CVE-2026-104627, an OpenID vulnerability that could allow an attacker to associate their own identity with another user’s account and subsequently sign in as that user. Gitea now requires a short-lived state parameter tied to the authenticated user when linking OpenID identities.
The update also fixes several information disclosure issues, including CVE-2026-110311, which could expose attachments from private repositories through the draft release functionality. Other patches address unauthorized interactions with locked issues, improper attachment permissions, and cross-site request forgery affecting repository topics.
Additionally, CVE-2026-105964 fixes a denial-of-service vulnerability in the Actions artifact v4 API where requests without size limits could exhaust server memory. Request bodies are now limited to 1 MiB.
On the functionality side, Gitea 28.2 brings several improvements to Actions. Canceled reusable workflows no longer remain indefinitely in the “canceling” state. Plus, scheduled workflows now correctly follow default branch changes, and workflow YAML parsing has been corrected.
Pull request handling has also been improved, fixing cases where empty PRs were incorrectly marked as merged. Review comments now display the proper code context. Filenames containing non-ASCII characters appear correctly in the diff file tree.
Other fixes restore compatibility with older npm package tarball URLs, improve WebAuthn authentication with WebKit clients, and prevent certain notification service errors from crashing Gitea.
Given the number and nature of the security fixes, the Gitea team strongly recommends upgrading as soon as possible. For more information, see the official release announcement.
