Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyBest value · save 44%$999/year$83.25/mo, billed yearly. Save $789 vs monthly (5+ months free).Monthly$149/monthBilled monthly. Cancel anytime.

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

← Live incidents
LivePatchedPatch now

Gitea 28.3.0 security release: OAuth2 account-linking takeover and Actions/token fixes

Gitea

Brought to you byTinkerer Club

The private club for people who own their servers, run their own AI, and pay $0/month for software.

Gitea 28.3.0 (third maintenance release of the 28 series) ships a large security batch. CVE-2026-120263: when ACCOUNT_LINKING=auto and registration is enabled, the link-account sign-up form looked up the account to link by attacker-submitted username/email instead of the OAuth2 identity, allowing passwordless takeover of existing accounts. The release also fixes high-severity Actions issues (fork workflows obtaining secrets/write tokens via review commit_id; Actions task tokens authenticating to the REST API without scope), stored XSS via artifact Content-Encoding, write-collaborator release/milestone/label destruction on archived repos, and additional medium issues around token scopes. Gitea strongly recommends upgrading ASAP. Fixed in 28.3.0.

Why this severity: OAuth2 auto-link account takeover (CVE-2026-120263) when ACCOUNT_LINKING=auto with open registration; multiple high Actions/token and XSS issues in the same 28.3.0 release

Started
Nov 1, 2026
CVE
CVE-2026-120263

Follow this incident

Discuss on X ↗

Affected

  • Gitea before 28.3.0 (see individual GHSAs; OAuth2 linking mis-bind requires ACCOUNT_LINKING=auto and open registration)

Fixed in

  • 28.3.0

Timeline2

  1. Gitea publishes multiple security advisories for the 28.3.0 release, including GHSA-8p3x-w464-4g6v (OAuth2 account linking) and high-severity Actions/token issues.

  2. Gitea blog: Release of 28.3.0 documents CVE-2026-120263 and related security fixes; strongly recommends upgrading.

Advisories4

Notes & caveats

Distinct from closed KEV entry gitea-gitea-cve-2026-60004. Release also mentions Go 1.27.3 cert distrust (CVE-2026-111943) affecting outgoing TLS trust — tracked here only as context in the vendor blog, not a Gitea app bug.

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Sponsored

Buy sponsor slot · $149/mo