Critical Gitea Vulnerabilities Allow Attackers to Bypass Authentication and Execute Code

Gitea has released version 28.0.0, addressing 20 vulnerabilities spanning authentication bypass, unauthorized workflow execution, server-side request forgery , and access-control failures. Published September 30, 2026, the release removes the historical “1.” version prefix. Maintainers urged users to upgrade promptly, although the announcement does not provide severity scores or report active exploitation. One authentication flaw, CVE-2026-103059, affects Gitea’s built-in SSH…