felhom.eu/documentation/audits/security-app-updates-2026-10-27/triage-notes/gitea.md

gitea — triage (group C, 2026-10-27)

Pin: gitea/gitea:1.27.3. Template: setup_gate + signup_block (/user/sign_up) + DISABLE_REGISTRATION after setup; sqlite; only port 3000 routed (no SSH port published, image's built-in SSH server off = default START_SSH_SERVER=false); Actions + Packages left at upstream default (ON); no runner shipped; migrations/mirrors at default (ALLOWED_DOMAINS unset, ALLOW_LOCALNETWORKS=false).

Version line

Gitea dropped the "1." prefix: 28.0.0 (2026-09-29) is the successor of 1.27.3 (secondary coverage: alternativeto.net, zeli.app; Go module renamed to gitea.dev, which is the package name in every new GHSA). No 1.27.4 exists (Docker Hub tag list read 2026-10-27: highest 1.27.x = 1.27.3). By the project rule the first number moves 1 -> 28 = new main version. Docker tags: 28.0.0 / 28.1.0 / 28.2.0 (no v).

Notices (41)

NOT-A-FINDING (1): GHSA-x4q3-gcj3-m6cf — package gitea.com/gitea/runner (act_runner); our template ships no runner. REAL (40) — all in range <= 1.27.3 / <= 28.0.0 / <= 28.1.0:

• fixed 28.0.0: GHSA-467c, 4j4g, 54w9, 6g2h, 6pv5 (crit), 7769, 7cq7 (crit), 8pwg (crit), 93pj (crit), 9h7g, fqjr, g4hw, hcgw, mw6q, p3pc, p3rv, pvjf (crit), x8c3, xfqq, xh39
• fixed 28.1.0: GHSA-469m, 7v5j, 8hhh, 94rx, 96qg, fx95, hf55, jj5r, vvqw, xmfc
• fixed 28.2.0: GHSA-4jmf, 6f9g, 8j56, c3cr, cwq7, fxq4, mf69, vcp6, wx44
• NO FIX: GHSA-rqhx-647v-wx32 (migration SSRF via HTTP redirect; fix 1.26.3 was REVERTED; gitea.dev >=1.27.1 open, no patched version). Reachability with OUR template (strangers cannot get an account: setup gate, then sign-up blocked twice):
• Needs a household account (any user): 7cq7 container-registry stored XSS (Packages on), 6pv5, mw6q (instance crash), hcgw/p3pc/6g2h/g4hw/jj5r (mirror/migration SSRF/DoS), 94rx, 96qg, vvqw, cwq7, 8j56, fxq4, wx44, 4jmf (CSRF, victim must be signed in), xmfc, xfqq, x8c3, 7769, 469m, mf69, 467c.
• Not reachable (feature off / absent): 8pwg + vcp6 (built-in SSH server off, no SSH port routed; vcp6 also needs SSH_TRUSTED_USER_CA_KEYS); Actions-runner chain pvjf/93pj/4j4g/xh39/6f9g (no runner => jobs never run; p3rv memory DoS still fires at run creation, needs an account); 54w9/fqjr (need ALLOWED_DOMAINS set); 7v5j (needs IMPORT_LOCAL_PATHS); 8hhh (needs DISABLE_NEW_PUSH); fx95 (needs FORCE_PRIVATE); 9h7g (needs INSTALL_LOCK reset).
• Anonymous: c3cr (500/panic on /{user}/-/repositories, recovered per request), hf55 (activity feed of limited/private users via Accept header). Worst real: critical (7cq7, 6pv5 reachable by a household account).

Fix

Smallest fixing all fixable: 28.2.0. TARGET: gitea/gitea:28.2.0 (newest stable; same-main target does not exist). Same main: NO (1 -> 28). Breaking (read 28.0.0 [body truncated at 12000 chars], 28.1.0, 28.2.0): 28.0.0 BREAKING #39426 Git network ops routed through an internal proxy + new egress settings; #38855 RUN_RETENTION_DAYS deletes old Actions runs; per release coverage: self-registration off by default (we set it explicitly), a wildcard BLOCKED_DOMAINS can stop startup (we set none). 28.1.0/28.2.0: none found. Lane: BIG_STEP (40) + NO_FIX (rqhx). rqhx is likely closed by 28.0.0's egress proxy but the advisory names no fix — unsure.

NO_FIX rqhx

Blocks it: only a household account can start a migration; strangers have no account. Options: (A) set GITEA__repository__DISABLE_MIGRATIONS=true — cost: the household cannot import repos from GitHub etc.; (B) take 28.2.0 (BIG_STEP) and re-test the redirect against the new egress proxy — cost: a bench + box walk. If nothing: a household member could make Gitea fetch an internal address on the box network (a trusted-insider risk only).

Classifier note

x4q3 is package gitea.com/gitea/runner, not the server: match the advisory's package, not the repo. The 1.27 -> 28 rename should be stated in the item (it reads like a jump of 27 majors).