Gitea 28.2.0
Package
Gitea 28.2 is a security release fixing nine vulnerabilities, including SSH certificate principal validation and OpenID account linking flaws that could allow signing in as another user.
Download BINARY Project website ↗Download Mirrors
Gitea 28.2.0 was released on October 18, 2026. It is a security release; we covered the fixes in the news. The major release before it is Gitea 28.0.0.
Security fixes
- SSH certificate principals were not validated properly, allowing authentication as another user in some configurations
- OpenID linking could let an attacker sign in as another user
- Private repository attachments could leak through draft releases
- The Actions artifact API could be used to exhaust server memory
- Fixes for locked issues, attachment permissions, and CSRF on repository topics
Upgrading
Back up the database, repositories, and app.ini, then replace the binary and restart:
wget -O gitea https://dl.gitea.com/gitea/28.2.0/gitea-28.2.0-linux-amd64
chmod +x gitea
sudo systemctl stop gitea
sudo install -m 0755 gitea /usr/local/bin/gitea
sudo systemctl start giteaContainer users can pull gitea/gitea:28.2. Adjust the binary path to match your installation.
Verify Your Download
Each binary on dl.gitea.com has matching .sha256 and GPG .asc signature files.