Skip to content
Gitea Releases Security Update for Multiple Vulnerabilities

Gitea Releases Security Update for Multiple Vulnerabilities

First seen 18 Oct 2026, 20:07 UTC •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 18, 2026 at 20:39 UTC
  • •Gitea 28.2.0 released on October 18, 2026, with critical security fixes.
  • •CVE-2026-104627 allows attackers to exploit OpenID linking without user consent.
  • •Users are urged to upgrade immediately to protect against these vulnerabilities.

Gitea has released version 28.2.0, addressing several security vulnerabilities, including CVE-2026-104627, which allows an attacker to link their OpenID identity to a victim's account without proper verification. This flaw affects users who utilize OpenID for authentication, potentially enabling unauthorized access. The vulnerabilities were disclosed on October 18, 2026, and users are strongly urged to upgrade to the latest version to mitigate risks. Other vulnerabilities fixed include CVE-2026-109553 and CVE-2026-107686, which involve improper handling of SSH certificates and reactions on locked issues, respectively. The release includes security fixes and bug improvements for various features such as Actions, pull requests, and authentication.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-08
CVE-2026-78659 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-18
Gitea 28.2.0 released
Version 28.2.0 released to address multiple security vulnerabilities, including CVE-2026-104627.
blog.gitea.com
2026-10-18
CVE-2026-104627 published
CVE-2026-104627 disclosed, detailing vulnerabilities in OpenID linking that could allow unauthorized access.
github.com
2026-10-18
CVE-2026-105661 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-18
CVE-2026-105964 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-18
CVE-2026-107618 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-18
CVE-2026-107686 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-18
CVE-2026-109553 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-18
CVE-2026-109844 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-18
CVE-2026-110311 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (2)

Following this threat?

Track CVE-2026-104627 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (18)

1 / 4

Common questions

What versions are affected?
All versions prior to Gitea 28.2.0 are affected by the vulnerabilities.
How urgent is the upgrade?
The upgrade is urgent due to the potential for unauthorized access through the OpenID vulnerability.
What should I do if I can't upgrade immediately?
If immediate upgrading is not possible, consider disabling OpenID authentication temporarily until the upgrade can be applied.