Gitea 28.2 fixes nine security vulnerabilities, including SSH auth bypass

Gitea released version 28.2, patching nine of 12 disclosed vulnerabilities. The most serious, CVE-2026-109553, lets an attacker authenticate as another user via certificate principals, while CVE-2026-104627 allows linking a foreign OpenID identity to an account. The team urges immediate upgrades.

• CVE-2026-109553 allows signing in as another user via certificate principals
• CVE-2026-104627 lets an attacker link their OpenID to another account and log in
• CVE-2026-105964: DoS in Actions artifact v4 API, request bodies capped at 1 MiB
• Fixes include private-repo attachment leaks and CSRF on repository topics