The current version of Gitea is 28.1.0 (as of 06/10/2026). patchletter checks the official source daily and emails you new releases.
Actively exploited vulnerabilities
The US cybersecurity agency CISA lists this vulnerability in its catalog of Known Exploited Vulnerabilities. What CISA does not carry does not appear in this list — even where it is being exploited.
- CVE-2026-60004Gitea Code Injection Vulnerability
CISA deadline was 28 Aug
Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.
BSI security advisories
Advisories the German BSI (CERT-Bund) published for this product. Whether your version is affected is stated in the advisory itself.
- Gitea: Mehrere Schwachstellen
WID-SEC-W-2026-3792 · 7 Oct
- Gitea: Mehrere Schwachstellen
WID-SEC-W-2026-2863 · 7 Oct
- Gitea: Schwachstelle ermöglicht Offenlegung von Informationen
WID-SEC-W-2026-3669 · 30 Sept
- Golang Go: Mehrere Schwachstellen
WID-SEC-W-2025-0283 · 29 Sept
- Golang Go: Schwachstelle ermöglicht Offenlegung von Informationen
WID-SEC-W-2025-0263 · 29 Sept
- Gitea: Schwachstelle ermöglicht Offenlegung von Informationen
WID-SEC-W-2026-3543 · 24 Sept
- Gitea: Schwachstelle ermöglicht Offenlegung von Informationen
WID-SEC-W-2026-3524 · 23 Sept
- SSH Protokoll: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen
WID-SEC-W-2023-3174 · 16 Sept
Gitea at a glance
Gitea is a lightweight, self-hosted Git service — a popular, easy-to-run alternative to larger platforms, common in homelabs and SMBs. Gitea ships regular releases plus security fixes; as a system holding source code and often reachable from the network, timely patching matters.
For admins updates are usually straightforward (swap the binary/container), but back up the database and the repository/data directory first, since upgrades run migrations — and read the release notes for breaking changes before larger jumps. Gitea holds code, credentials and often CI tokens, so keep it behind authentication (two-factor, ideally SSO) and off the open internet unless deliberately hardened. Its built-in Actions runners execute pipeline code — isolate them. After updating, verify logins, pushes and integrations. The community fork Forgejo shares its lineage. Track releases so security fixes aren't missed.
Version history & changelog · as detected by patchletter
| Version | Channel | Date | Notes |
|---|---|---|---|
| 28.1.0 | STABLE | 06/10/2026 | Release notes → |
| 28.0.0 | STABLE | 30/09/2026 | Release notes → |
| 1.27.3 | STABLE | 29/08/2026 | Release notes → |
| 1.27.2 | STABLE | 13/08/2026 | Release notes → |
| 1.27.1 | STABLE | 27/07/2026 | Release notes → |
| 1.27.0 | STABLE | 13/07/2026 | Release notes → |
| 1.26.4 | STABLE | 21/06/2026 | Release notes → |
| 1.26.3 | STABLE | 20/06/2026 | Release notes → |
| 1.26.2 | STABLE | 20/05/2026 | Release notes → |
| 1.26.1 | STABLE | 25/04/2026 | Release notes → |
| 1.26.0 | STABLE | 18/04/2026 | Release notes → |
| 1.25.5 | STABLE | 13/03/2026 | Release notes → |
| 1.25.4 | STABLE | 22/01/2026 | Release notes → |
| 1.25.3 | STABLE | 18/12/2025 | Release notes → |
| 1.25.2 | STABLE | 22/11/2025 | Release notes → |
| 1.25.1 | STABLE | 04/11/2025 | Release notes → |
| 1.25.0 | STABLE | 29/10/2025 | Release notes → |
| 1.24.7 | STABLE | 25/10/2025 | Release notes → |
| 1.24.6 | STABLE | 11/09/2025 | Release notes → |
| 1.24.5 | STABLE | 13/08/2025 | Release notes → |
| 1.24.4 | STABLE | 04/08/2025 | Release notes → |
| 1.24.3 | STABLE | 15/07/2025 | Release notes → |
| 1.24.2 | STABLE | 20/06/2025 | Release notes → |
| 1.24.1 | STABLE | 19/06/2025 | Release notes → |
| 1.24.0 | STABLE | 10/06/2025 | Release notes → |
| 1.23.8 | STABLE | 13/05/2025 | Release notes → |
Frequently asked questions
- What is the latest version of Gitea?
- Gitea 28.1.0, released 06/10/2026. patchletter checks the vendor's official source daily for new releases.
- Where can I find the Gitea release notes?
- The version history above links to the vendor's official release notes where the vendor publishes them. patchletter deliberately stores no vendor full texts.
- How do I get notified about new Gitea updates?
- Tick Gitea off in the catalogue and leave your address. From then on new versions go out by email — one at a time, or bundled in the daily or weekly digest.
An email as soon as a new Gitea version ships
We reconcile the vendor source daily. When a new version appears, it lands in your inbox right away or bundled as a digest. The update email is free and ends with one click. Alerts about vulnerabilities and end of support are part of patchletter Pro.
Embed this badge
The badge shows the current Gitea version and keeps it up to date. Anyone may embed it, no account needed.
[](https://patchletter.com/en/software/gitea)https://patchletter.com/badge/gitea.svgAlso available: ?v=eol (end of support) and ?v=cve (actively exploited).