Gitea 28.3.0 patches OAuth2 account takeover flaw
The bug was found by Anthropic's Claude model and validated by Doyensec; it affects installs with automatic account linking enabled.
Gitea released version 28.3.0 on November 1, 2026, fixing several security issues, including an OAuth2 account takeover vulnerability tracked as CVE-2026-120263, and urged users to update promptly, according to dailysecu.com.
CVE-2026-120263 sits in the OAuth2 account-linking process and lets an attacker link their own external login account to an existing Gitea account without knowing the victim's password. It affects installations that have 'ACCOUNT_LINKING = auto' enabled and allow new user registration; the default setting requires verification of the existing account's password.
According to the official advisory, the flaw was found by Anthropic's AI model Claude and validated by Doyensec researchers in cooperation with Anthropic Research.
Other fixes in the release
Version 28.3.0 also addresses CVE-2026-113429, a stored XSS flaw in downloading artifacts from Gitea Actions that can run malicious script in Gitea's security context.
A third issue, CVE-2026-112887, lets tokens issued for automation jobs list other private repositories on the server, exposing their existence and related information but not file contents.
Quick answers
Which Gitea version fixes CVE-2026-120263?
Version 28.3.0, released on November 1, 2026, patches the account takeover flaw along with other security issues.
Who found the OAuth2 account-linking flaw?
According to the official advisory, Anthropic's AI model Claude found it, and Doyensec researchers validated it with Anthropic Research.
Which configurations are affected by CVE-2026-120263?
Installations with 'ACCOUNT_LINKING = auto' enabled that also allow new user registration; the default setting verifies the existing account's password.