Gitea 28.1.0 fixes 27 flaws, including CVE-2026-103670

Gitea 28.0.0 and 28.1.0 patched 27 security issues: one critical, four high and five medium. The top score of 9.1 belongs to CVE-2026-103059 in the built-in SSH server, while CVE-2026-96404 (8.1) lets the web installer issue an admin session without a password check. ZoomEye matched 116,431 exposed Gitea instances.

• Gitea 28.0.0 and 28.1.0 fixed 27 flaws: 1 critical, 4 high, 5 medium
• CVE-2026-103059 in the SSH server scores CVSS 9.1, CVE-2026-96404 scores 8.1
• CVE-2026-103670 (7.5) requires fork pull request workflows to be enabled
• ZoomEye matched 116,431 exposed Gitea instances on October 7, 2026