The Largest Security Patch in Gitea's History
Gitea 1.27, released on July 19, 2026, is the most security-significant update the self-hosted Git platform has ever shipped. In a single release, it closes 45 CVEs — covering privilege escalation, server-side request forgery (SSRF), repository token abuse, and OAuth2 authentication flaws. For any team running their own Gitea instance, upgrading is not optional.
But security is only half the story. Gitea 1.27 also delivers three long-requested developer features that make it a meaningfully more capable platform.
Reusable Actions Workflows
Gitea Actions now supports reusable workflows. Jobs referenced in a pipeline file are parsed directly by Gitea and expanded into separate steps, bringing the platform in line with the workflow-sharing model GitHub Actions users have had for years. Teams managing a dozen repositories can define one shared CI template and reference it everywhere — no more copy-pasting YAML across repos and forgetting to sync changes.
Jupyter Notebook Rendering
Files with a .ipynb extension now render as formatted notebooks inside the Gitea web UI — code cells, outputs, and markdown sections displayed correctly rather than as raw JSON. This makes Gitea a genuinely viable home for data science and ML projects that live alongside application code, instead of forcing notebook authors to maintain a separate hosted viewer.
OpenAPI 3.0 Spec
Gitea now publishes its full API specification at /openapi.v1.json. API clients, documentation generators, and integration tools can now auto-discover Gitea's endpoints without relying on community-maintained third-party specs of uncertain accuracy.
The 45-CVE Security Batch
The scope of the vulnerabilities — especially the OAuth2 and SSRF categories — suggests the project brought in external security researchers rather than relying solely on community bug reports. Linuxiac confirmed that the patch batch was the result of coordinated disclosure with external researchers, which explains why so many CVEs land simultaneously rather than trickling in over time.
Self-hosted Git carries a higher operational burden than managed cloud platforms, and patch velocity is a real concern. A release of this scale makes a strong case for treating Gitea upgrades as a maintenance priority on par with OS patches — not something to schedule for next quarter's maintenance window. The OAuth2 and SSRF issues in particular are the kind that get actively scanned for on public-facing instances.
Gitea 1.27 is available now. Full release notes and the CVE list are on the official Gitea blog.