Gitea fixes 27 flaws, including fork-PR approval bypass

Gitea 28.0.0 and 28.1.0 together close 27 security issues, four of them touching runner trust for fork pull requests. CVE-2026-103670, rated 7.5, lets an unapproved fork run cancel a trusted workflow; no in-the-wild exploitation is confirmed.

• Gitea 28.0.0 and 28.1.0 fix 27 vulnerabilities, four on runner trust
• CVE-2026-103670 (CVSS 7.5): trusted workflow cancellation via unapproved fork run
• ZoomEye matched 116,431 hosts with the Gitea fingerprint on October 7, 2026
• Upgrade to 28.1.0 and keep secrets out of fork-triggered workflows