# Gitea 28.3.0 security release: OAuth2 account-linking takeover and Actions/token fixes · pwn.watch

> Gitea 28.3.0 (third maintenance release of the 28 series) ships a large security batch. CVE-2026-120263: when ACCOUNT_LINKING=auto and registration is enabled, the link-account sign-up form looked up the account to link by attacker-submitted username/email instead of the OAuth2 identity, allowing passwordless takeover of existing accounts. The release also fixes high-severity Actions issues (fork workflows obtaining secrets/write tokens via review commit_id; Actions task tokens authenticating to the REST API without scope), stored XSS via artifact Content-Encoding, write-collaborator release/milestone/label destruction on archived repos, and additional medium issues around token scopes. Gitea strongly recommends upgrading ASAP. Fixed in 28.3.0.

Page: https://pwn.watch/i/gitea-28-3-0-security-release-nov-2026 · generated 2026-11-06T18:34:57.853Z

## Status
- Severity: high · status: live · patch: patched
- Product: Gitea
- Started: 2026-11-01
- CVEs: CVE-2026-120263
- Affected: Gitea before 28.3.0 (see individual GHSAs; OAuth2 linking mis-bind requires ACCOUNT_LINKING=auto and open registration)
- Fixed in: 28.3.0

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/gitea-28-3-0-security-release-nov-2026/feed.xml
- JSON Feed: https://pwn.watch/i/gitea-28-3-0-security-release-nov-2026/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/gitea-28-3-0-security-release-nov-2026.json
- This file: https://pwn.watch/i/gitea-28-3-0-security-release-nov-2026/llms.txt

## Updates (newest first)
- 2026-11-01: Gitea publishes multiple security advisories for the 28.3.0 release, including GHSA-8p3x-w464-4g6v (OAuth2 account linking) and high-severity Actions/token issues. (https://github.com/go-gitea/gitea/security/advisories/GHSA-8p3x-w464-4g6v)
- 2026-11-01: Gitea blog: Release of 28.3.0 documents CVE-2026-120263 and related security fixes; strongly recommends upgrading. (https://blog.gitea.com/release-of-28.3.0/)

## Fix brief
# Security brief: Gitea 28.3.0 security release: OAuth2 account-linking takeover and Actions/token fixes

Source: https://pwn.watch/i/gitea-28-3-0-security-release-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 16:19 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
Gitea 28.3.0 (third maintenance release of the 28 series) ships a large security batch. CVE-2026-120263: when ACCOUNT_LINKING=auto and registration is enabled, the link-account sign-up form looked up the account to link by attacker-submitted username/email instead of the OAuth2 identity, allowing passwordless takeover of existing accounts. The release also fixes high-severity Actions issues (fork workflows obtaining secrets/write tokens via review commit_id; Actions task tokens authenticating to the REST API without scope), stored XSS via artifact Content-Encoding, write-collaborator release/milestone/label destruction on archived repos, and additional medium issues around token scopes. Gitea strongly recommends upgrading ASAP. Fixed in 28.3.0.

Severity detail: OAuth2 auto-link account takeover (CVE-2026-120263) when ACCOUNT_LINKING=auto with open registration; multiple high Actions/token and XSS issues in the same 28.3.0 release

- Product: Gitea
- CVE / advisory ids: CVE-2026-120263

## Affected versions
- Gitea before 28.3.0 (see individual GHSAs; OAuth2 linking mis-bind requires ACCOUNT_LINKING=auto and open registration)

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 28.3.0

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Nov 1, 2026: Gitea publishes multiple security advisories for the 28.3.0 release, including GHSA-8p3x-w464-4g6v (OAuth2 account linking) and high-severity Actions/token issues.
- Nov 1, 2026: Gitea blog: Release of 28.3.0 documents CVE-2026-120263 and related security fixes; strongly recommends upgrading.

## Advisories
- [Gitea 28.3.0 release (security section)](https://blog.gitea.com/release-of-28.3.0/) (Gitea)
- [OAuth2 account linking takeover (GHSA-8p3x-w464-4g6v / CVE-2026-120263)](https://github.com/go-gitea/gitea/security/advisories/GHSA-8p3x-w464-4g6v) (Gitea)
- [NVD: CVE-2026-120263](https://nvd.nist.gov/vuln/detail/CVE-2026-120263) (NVD)
- [Gitea 28.3.0 GitHub release](https://github.com/go-gitea/gitea/releases/tag/v28.3.0) (Gitea)

## Caveats
Distinct from closed KEV entry gitea-gitea-cve-2026-60004. Release also mentions Go 1.27.3 cert distrust (CVE-2026-111943) affecting outgoing TLS trust — tracked here only as context in the vendor blog, not a Gitea app bug.

---
Machine-readable: https://pwn.watch/i/gitea-28-3-0-security-release-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.