Gitea, the self-hosted Git service and software development platform, has released version 28.3, the third maintenance update in the 28.x series, addressing many security vulnerabilities.
Many of them involve weak enforcement of access token permissions, potentially allowing restricted tokens to access private repository information or perform operations beyond their scope.
Among the more serious fixes is CVE-2026-120263, an OAuth2 account takeover vulnerability affecting installations with automatic account linking and open registration. Under these conditions, an attacker could link an external identity to an existing account and sign in without its password.
Another notable issue, CVE-2026-118386, concerns Actions workflows triggered by pull request reviews. A user with read access could cause workflows to execute without approval, gaining access to repository secrets and a token with write permissions. The update changes how these workflows select the commit they run from.
Additional security fixes address unauthorized access to private repositories via API endpoints, exposure of private issues and pull requests, improper handling of organization runner registration tokens, and a stored cross-site scripting vulnerability involving legacy Actions artifacts.
Apart from the security fixes, Gitea 28.3 introduces several performance improvements. Issue and pull request dashboards now load faster, as do repository issue and pull request lists. Commit status processing is also optimized to avoid repeatedly loading the same repository.
The Actions subsystem receives further improvements, including cached runner token verification, reduced SQLite overhead when accessing job queues, and a fix preventing runners from picking up jobs from repositories where Actions is disabled.
Repository management benefits from several corrections too. Contributor statistics no longer get stuck during generation, diffs involving renamed files now load both file versions correctly, and the file viewer and editor respect the .editorconfig configuration for the selected Git reference.
Finally, migration reliability is improved through cursor-based pagination for GitHub issue migrations and restored compatibility with OneDev 16.8 and newer.
For more information, visit the official release announcement.
