# Gitea 28.3 patches 20 security flaws including OAuth2 account takeover, Actions secret exposure

> **Key takeaway:** Gitea 28.3 fixes critical OAuth2 and Actions vulnerabilities while improving dashboard and repository performance for self-hosted Git instances.

**Published:** 2026-11-01T14:57:55+00:00 
**Source:** Linuxiac 
**Category:** distro-news 
**Canonical URL:** https://fosswire.org/news/gitea-283-patches-20-security-flaws-including-oauth2-account.html 

## Summary
Gitea 28.3, the third maintenance release in the 28.x series, patches 20 security vulnerabilities across the self-hosted Git platform. The most severe flaws include CVE-2026-120263, an OAuth2 account takeover when automatic account linking and open registration are both enabled, and CVE-2026-118386, which allows pull request review workflows to execute without approval and expose repository secrets to users with only read access. Multiple additional fixes address weak access token permission enforcement, unauthorized API access to private repositories, exposure of private issues and pull requests, and stored cross-site scripting through legacy Actions artifacts.

Beyond security, the release delivers performance gains for issue and pull request dashboards, repository lists, and commit status processing. The Actions subsystem gains cached runner token verification and reduced SQLite overhead, while repository management sees fixes for contributor statistics generation, renamed file diffs, and .editorconfig handling. Migration tooling also improves with cursor-based pagination for GitHub issue imports and restored OneDev 16.8 compatibility.

## Security and performance changes in Gitea 28.3
- **OAuth2 account takeover (CVE-2026-120263):** Installations with automatic account linking and open registration allowed attackers to link an external identity to an existing account and authenticate without the account password.
- **Actions workflow bypass (CVE-2026-118386):** Pull request reviews could trigger workflow execution without required approval, granting read-access users access to repository secrets and write-permission tokens; the fix changes commit selection logic for these workflows.
- **Access token permission enforcement:** Multiple vulnerabilities involved restricted tokens gaining access to private repository data or performing operations outside their authorized scope.
- **Actions subsystem hardening:** Cached runner token verification reduces repeated authentication overhead, SQLite job queue access is optimized, and runners are now blocked from picking up jobs in repositories where Actions is disabled.
- **Repository and migration fixes:** Contributor statistics generation no longer hangs, renamed file diffs correctly display both versions, .editorconfig respects the selected Git reference, and GitHub issue migrations use cursor-based pagination with restored OneDev 16.8 compatibility.

## Why it matters
Self-hosted Gitea instances, which serve as critical infrastructure for organizations avoiding proprietary Git platforms, require immediate patching given the severity and breadth of these vulnerabilities, particularly the OAuth2 and Actions flaws that bypass authentication and authorization boundaries. The performance improvements for issue tracking and Actions reduce operational overhead for teams running Gitea on modest hardware or with large repositories, reinforcing its position as a viable lightweight alternative to GitHub Enterprise and GitLab self-managed deployments.