Gitea 1.27.2 is released

August 14, 2026

bircniTechnical Oversight Committee

We are excited to announce the release of Gitea 1.27.2, the second patch release for the 1.27 series. It contains a large batch of security fixes alongside bug fixes for Gitea Actions, packages, LFS and the UI. We strongly recommend that all users upgrade as soon as possible.

Security

This release addresses the following security vulnerabilities. Please upgrade as soon as possible.

CVE-2026-73804: A token with only write:user scope could add an SSH key to its own account and then use HTTP Signature authentication to make API requests without any token scope enforcement, bypassing the API token scope boundary entirely. Fixed by #38862 / #38895. Thanks to @ohxorud-dev for reporting the issue, and to @wxiaoguang for the patch.
The Jupyter notebook renderer wrote javascript: short links verbatim into anchors, and the standalone /render/ endpoint ships no CSP, so a crafted .ipynb could execute JavaScript in a victim’s session and lead to account takeover. Fixed by #38864 / #38869. Thanks to @CynosureSec for reporting the issue, and to @wxiaoguang for the patch.
CVE-2026-73539: The markup Context field was passed unescaped into the external renderer command line, allowing argument injection into the rendering process and remote code execution as the Gitea service user on instances that use $GITEA_PREFIX_SRC / $GITEA_PREFIX_RAW in a RENDER_COMMAND. Fixed by #38885 / #38898. Thanks to @DshtAnger for reporting the issue, and to @wxiaoguang for the patch.
CVE-2026-73800: pull_request_target workflows resolved local reusable workflows (uses: ./...) from the fork’s HEAD commit instead of the base branch, letting attacker-controlled workflow code run with access to repository and organization secrets. Fixed by #38886 / #38897. Thanks to @chakradhar1228, @PhucQuan, @YuvalMil, @elmahy111 and @DshtAnger for reporting the issue, and to @bircni for the patch.
CVE-2026-73278: The OAuth2 and OpenID Connect sign-in paths only checked TOTP enrollment, so users whose sole second factor was WebAuthn received a full session without ever being challenged. Fixed by #38805 / #38810. Thanks to @MindflareX, @AdamKorcz and @jaeyoon-kim-dev for reporting the issue, and to @silverwind for the patch.
CVE-2026-73535: POST /user/openid/connect did not enforce second-factor authentication, so an attacker who knew a victim’s password could obtain a full session and permanently link an attacker-controlled OpenID identifier to the victim’s account — access that survived a password change. Fixed by #38805 / #38810. Thanks to @r0hanSH for reporting the issue, and to @silverwind for the patch.
CVE-2026-60008: The Jupyter notebook renderer interpolated the notebook’s language_info.name into a class attribute without the safe-attribute protection, on a path where the sanitizer is disabled, letting a repository file overlay and intercept clicks on a repository page. Fixed by #38793 / #38795. Thanks to @yagcioglutoprak for reporting the issue, and to @wxiaoguang for the patch.
CVE-2026-73814: A repository collaborator with Admin access could submit mode=4 to the collaboration access-mode endpoint to escalate to effective Owner permissions and transfer the repository to their own account. Fixed by #38894 / #38895. Thanks to @martindukek for reporting the issue, and to @wxiaoguang for the patch.

This release also updates the bundled mermaid dependency to v11.16.1 (#38816).

Notable fixes

Actions

workflow_dispatch inputs are kept as strings in github.event.inputs again, matching the documented behavior (#38908).
Re-running selected jobs can now read the previous attempt’s artifacts instead of starting from an empty artifact set (#38901).
Each ${{ }} part of an expression is evaluated on its own, fixing results for strings that contain several interpolations (#38797).
Runs without any running jobs can be cancelled again (#38812), and task reports are written in a single transaction to avoid partially recorded state (#38794).

Packages, LFS and storage

LFS: successful transfer responses from a client are accepted correctly (#38875), and a failed upload no longer deletes the meta object of a concurrent upload of the same object (#38722).
Swift packages: nested Package.swift files are ignored during package detection (#38836).
Arch packages: member names containing newlines are dropped while parsing (#38830).
The Alpine registry answers HEAD requests for APKINDEX.tar.gz instead of returning 405 (#38688).
Dumping to Azure Blob storage no longer fails with “file does not exist” (#38828), and a minimum part size is set for MinIO uploads when the content size is unknown (#38755).
npm packages now publish the previously missing metadata properties (#38831).

Repositories and UI

Archive downloads no longer break when Gitea runs under a sub-path (#38750), and full URLs are built correctly in that setup (#38716).
Markup rendering no longer panics on certain inputs (#38703), markup links are resolved correctly (#38765), and strikethrough is no longer applied twice on code spans (#38729).
The merge box is removed from the UI when a refreshed page no longer contains it (#38744), commit avatar stacks show the correct number of participants (#38700), and underlines use the default browser style again (#38823).
Deleting a migration redirects properly instead of returning a JSON redirect (#38825).

This release includes 26 merged pull requests, thanks to the amazing contributions from our community.

How to install or update

Download our pre-built binaries from the Gitea downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation

Special Thanks

We would also like to thank all of our supporters on Open Collective who are helping to sustain us financially.

Looking for a seamless, hassle-free solution to manage your Git repositories? Discover Gitea Cloud — A fully-managed, scalable platform designed to streamline your development workflow.

Changelog

1.27.2 - 2026-08-14

SECURITY
- Fix: update collaborator access mode and httpsign (#38894, #38862) (#38895)
- Refactor: external render (#38885) (#38898)
- Fix(actions): resolve pull_request_target reusable workflows at the base commit (#38886) (#38897)
- Refactor: markup render (#38864) (#38869)
- Fix(deps): update dependency mermaid to v11.16.1 (#38816)
- Fix(auth): set WebAuthn user verification per request (#38805) (#38810)
- Fix: render highlight language (#38793) (#38795)
ENHANCEMENTS
- Enhance: add missing npm package metadata properties (#38826) (#38831)
BUGFIXES
- Fix(actions): keep github.event.inputs as strings for workflow_dispatch (#38899) (#38908)
- Fix(actions): let a rerun of selected jobs read the previous attempt’s artifacts (#38857) (#38901)
- Fix(lfs): accept successful transfer responses (#38866) (#38875)
- Fix(packages): ignore nested Package.swift (#38788) (#38836)
- Fix: drop newline-bearing member names in arch ParsePackage (#38102) (#38830)
- Fix(storage): fix Azure Blob dump failing with file does not exist (#38814) (#38828)
- Fix(migration): migration deletion returned json redirection (#38796) (#38825)
- Fix(ui): change underlines to default browser style (#38819) (#38823)
- Fix(actions): allow cancelling runs without running jobs (#35842) (#38812)
- Fix(actions): evaluate each ${{ }} part on its own (#38754) (#38797)
- Fix(actions): write an action task report in one transaction (#38792) (#38794)
- Fix: markup link (#38764) (#38765)
- Fix: set a minio part size when the content size is unknown (#38753) (#38755)
- Fix: bad path escape in subpath archive download (#38749) (#38750)
- Fix: remove the pull merge box from UI when the refreshed page doesn’t contain it (#38742) (#38744)
- Fix(markdown): fix double strikethough on code (#38707) (#38729)
- Fix(lfs): failed upload deletes a concurrent upload’s meta object (#38693) (#38722)
- Fix: correct full url when using sub-path (#38712) (#38716)
- Fix: avoid markup render panic (#38698) (#38703)
- Fix(ui): too many participants shown in commit avatar stacks (#38689) (#38700)
- Fix: support HEAD requests on Alpine registry APKINDEX.tar.gz (#38686) (#38688)