Gitea Shipped 21 CVEs in One Release and Eleven of Them Are the Same Bug
- Created
- 10 Nov 2026
- Last reply
- about 11 hours ago
- Replies
- 0
- Views
- 0
- Reactions
- 0
Discussion of the blog article Gitea Shipped 21 CVEs in One Release and Eleven of Them Are the Same Bug.
Gitea 28.3.0 landed November 1 with twenty-one CVE fixes. Read the list and a pattern jumps out: more than half are the same failure repeated across different route handlers, where a token scoped to public data gets handed private data anyway. That's not twenty-one mistakes.
Discussion thread — share findings, corrections and follow-ups below.