Gitea has released version 28.0.0, addressing 20 vulnerabilities that pose significant security risks to users of the self-hosted Git service platform. According to reports published by Gbhackers, the vulnerabilities include authentication bypass mechanisms, unauthorized workflow execution, and server-side request forgery (SSRF) flaws that could be exploited by malicious actors.
The specific details regarding the nature and severity of each vulnerability were not fully enumerated in available sources. However, the breadth of the patch—covering 20 distinct issues—underscores the scope of security concerns identified in the platform. Gitea users are advised to upgrade to version 28.0.0 to mitigate these risks.
The release of this security update comes during a broader wave of critical vulnerability disclosures across the software industry. In the same timeframe, WordPress released version 7.1.3 on October 6, 2026, addressing vulnerabilities involving cross-site scripting, SQL injection, and information disclosure. Additionally, Cisco disclosed three critical vulnerabilities in its Nexus 3000 and 9000 Series switches on October 7, 2026, that could allow unauthenticated remote attackers to execute arbitrary code with root privileges.
The confluence of these security disclosures underscores the ongoing challenge software vendors and organizations face in identifying and remedying security flaws. For Gitea administrators and organizations running the platform, the release of version 28.0.0 represents a critical maintenance window that should be prioritized to prevent potential exploitation.
Organizations using Gitea should review the security advisory in detail to understand which vulnerabilities may affect their deployments and plan their update schedules accordingly. Given the severity classifications reported, testing and deployment of the update should be treated as urgent.
The sources consulted did not provide information on the timeline for discovery of these vulnerabilities, the number of users potentially affected, or whether any exploitation of these flaws has been documented in the wild prior to the release of the patch.
