Gitea Shipped 21 CVEs in One Release and Eleven of Them Are the Same Bug

Gitea 28.3.0 landed November 1 with twenty-one CVE fixes. Read the list and a pattern jumps out: more than half are the same failure repeated across different route handlers, where a token scoped to public data gets handed private data anyway. That's not twenty-one mistakes.

Read the full article →

Discussion thread — share findings, corrections and follow-ups below.