Gitea 1.26.4 Security Release: Multiple CVEs Fixed (SSRF/Pre-Auth/ReDoS)

Vulnerability Overview Gitea versions 1.26.3 and 1.26.4 have been released, containing multiple security fixes. The key vulnerabilities include: 1. CVE-2026-20896: The Docker image had set by default, allowing any source IP to impersonate users via the header. 2. CVE-2026-22874: The default allowlist filter was too permissive, potentially leading to SSRF attacks targeting internal addresses. 3. CVE-2026-27775: Branch write permissions were re-checked, allowing the bypass of the pre-receive hook cache's first ref result during a push. 4. CVE-2026-24451: Fork synchronization (merge-upstream) is blocked when the base repository is no longer readable; previously, forks could not pull commits after the parent switched to private. 5. CVE-2026-20779: Enforced single-use TOTP passwords, closing TOCTOU race conditions and stateless replay windows. 6. CVE-2026-28740: Required code unit access for cross-repository LFS object reuse, preventing unauthorized access to private objects. 7. CVE-2026-27761: Enforced repository token scoping, preventing RSS/Atom endpoints from reading private repository commit data. 8. CVE-2026-25038: Enforced organization visibility, preventing organization labels from leaking to non-members. 9. CVE-2026-28740: Blocked HTTP redirects, preventing SSRF attacks reaching internal addresses via attacker-controlled redirects. 10. CVE-2026-28740: Bounded CODEOWNERS pattern matching time, preventing unauthenticated ReDoS denial of service. 11. CVE-2026-28740: After revocation of notifications, private issue and pull request metadata no longer leak via the notifications API. Affected Versions CVE-2026-20896: Affects all users using the Docker image. CVE-2026-22874: Affects users utilizing webhooks and migrations. CVE-2026-27775: Affects users utilizing pre-receive hooks. CVE-2026-24451: Affects users utilizing fork synchronization. CVE-2026-20779: Affects users utilizing TOTP passwords. CVE-2026-28740: Affects users utilizing cross-repository LFS object reuse. CVE-2026-27761: Affects users utilizing RSS/Atom endpoints. CVE-2026-25038: Affects users utilizing organization labels. CVE-2026-28740: Affects users utilizing HTTP redirects. CVE-2026-28740: Affects users utilizing CODEOWNERS. CVE-2026-28740: Affects users utilizing the notifications API. Remediation CVE-2026-20896: Set to empty or to specific trusted proxies. CVE-2026-22874: Tighten the default allowlist filter. CVE-2026-27775: Re-check branch write permissions. CVE-2026-24451: Block fork synchronization. CVE-2026-20779: Enforce single-use TOTP passwords. CVE-2026-28740: Require code unit access for cross-repository LFS object reuse. CVE-2026-27761: Enforce repository token scoping. CVE-2026-25038: Enforce organization visibility. CVE-2026-28740: Block HTTP redirects. CVE-2026-28740: Bound CODEOWNERS pattern matching time. CVE-2026-28740: Stop leaking private issue and pull request metadata after notification revocation. Update Recommendations It is strongly recommended to upgrade directly to Gitea 1.26.4. If you are already on 1.26.3, please upgrade to 1.26.4 as soon as possible. Installation or Update Download pre-built binaries from the Gitea Download Page, ensuring you select the version compatible with your platform. For step-by-step guides on installation or upgrades, refer to the Installation Documentation. Special Thanks Thanks to all sponsors supporting Gitea on Open Collective, helping us maintain financial stability. Community Participation Join the Gitea community by starring our repository on GitHub and joining our Discord server. Subscribe to Newsletter Subscribe to our newsletter to stay updated on all Gitea news. Tags release Edit this page Edit this page New Articles Gitea Runner 2.0.0 Released Old Articles TOC Election 2026 Join Our Community Gitea is open source. Star our GitHub repository and join our community on Discord. Go to GitHub Join Discord Subscribe to Our Newsletter Subscribe to our newsletter to receive the latest Gitea updates. Subscribe Documentation Tutorial Community Stack Overflow Discord Twitter More Code

Goal Reached Thanks to every supporter — we hit 100%!

Gitea 1.26.4 Security Release: Multiple CVEs Fixed (SSRF/Pre-Auth/ReDoS)