Skip to content

Gitea Enterprise 26.4.0 is released

Gitea Enterprise 26.4.0 is released
Gitea Team
5 min read

We are excited to announce the release of Gitea Enterprise 26.4.0! This release adds access controls for the DevOps dashboard, extends audit logging to failed sign-in attempts, and picks up a substantial round of upstream security hardening from Gitea v1.26.3 and v1.26.4. It also rolls up the 26.3.1 patch release. We strongly recommend upgrading to benefit from the latest hardening work — especially the fixes called out below.

The embedded Gitea was updated from v1.26.2 to v1.26.4, which brings a large batch of security fixes:

Authentication & Access Control

  • Disabled users are no longer auto-reactivated on the OAuth2 callback (#38009) (#38183)
  • Stale OIDC external login links to organizations are now ignored (#37875) (#38141)
  • Private repositories can no longer be cloned through anonymous code access (#38074) (#38146)
  • Cross-repository LFS object reuse now requires Code-unit access, and unknown SSH LFS sub-verbs are rejected to prevent an auth bypass (#38006) (#38008)

Request Filtering & Resource Limits

  • The host matcher's private list was corrected, and reserved IP ranges are now blocked from external/private filters (#38170) (#38039)
  • CODEOWNERS regex matching is time-bounded, and Debian control-file parsing is bounded to a single stanza (#38011) (#38044)

Dependency Update

  • golang.org/x/net was updated to v0.55.0 to address a security advisory (#37813) (#37829)

Major Breaking changes

Gitea Enterprise introduces no breaking changes in 26.4.0. One upstream behavior change is worth noting: as of Gitea v1.26.3, a pull request from a fork must be merged before it can bypass the fork approval gate for Actions (#38010). Workflows that relied on the previous behavior may now require an explicit approval.

Major Highlights

🚀 Access controls for the DevOps dashboard

The DevOps dashboard introduced in 26.3.0 is now permission-aware. Administrators can configure dashboard access modes for both the global and the organization scope, and page access, data endpoints and exports are all enforced against that setting. Metrics are filtered by visibility scope and the dashboard cache is isolated per visibility level, so users only ever see the data they are entitled to. Organization navigation and organization settings surface whether the org dashboard is available.

🚀 Audit log for failed sign-in attempts

A new user:sign_in_failed audit event records unsuccessful authentication attempts, giving compliance and security teams a first-class record of brute-force or credential-stuffing activity without having to parse raw application logs.

🚀 Inactive users can be added as collaborators

Accounts that are not yet activated can now be added as repository collaborators. Onboarding no longer has to wait for the user to complete activation before permissions are put in place.

🚀 Reusable workflow caller jobs reported to the runner controller

The runner controller now receives caller jobs of reusable workflows as waiting jobs, giving autoscaling setups an accurate view of pending work when workflows are composed from reusable definitions.

How to install or update

Download our pre-built binaries from the Gitea Enterprise downloads page — make sure to select the version compatible with your platform. For a step-by-step guide on installation or upgrades, check out our installation documentation

Changelog

26.4.0 - 2026-06-26

Enterprise

  • Features
    • Add DevOps dashboard access controls
    • Add user:sign_in_failed audit log
    • Allow adding inactive users as collaborators
    • Return reusable workflow caller jobs as waiting jobs to runner controller
    • Add DevOps dashboard license check
  • BugFixes
    • Deny DevOps dashboard access when the feature is disabled
    • Fix DevOps dashboard display
    • Fix template lint issues
    • Fix release workflow
  • Build
    • Use Gitea artifact upload action in release workflow
    • Optimize EE release and branch CI workflows
    • Add smoke test for docker build

This release also includes features from Gitea versions v1.26.3 ~ v1.26.4

v1.26.4

  • SECURITY
    • fix(auth): do not auto-reactivate disabled users on OAuth2 callback (#38009) (#38183)
  • BUGFIXES

v1.26.3

  • BREAKING
    • fix(actions)!: require merged PR to bypass fork PR approval gate (#38010) (#38041)
  • SECURITY
    • fix(hostmatcher): patch incorrect private list (#38170) (#38173)
    • fix: Various security fixes (#38103) (#38151)
    • fix: Various sec fixes (#38108) (#38147)
    • fix: allow git clone of private repos with anonymous code access (#38074) (#38146)
    • fix(auth): ignore stale OIDC external login links to organizations (#37875) (#38141)
    • fix(hostmatcher): block reserved IP ranges from external/private filters (#38039) (#38059)
    • fix(lfs): require Code-unit access for cross-repo LFS object reuse (#38006) (#38050)
    • fix(lfs): reject unknown SSH LFS sub-verbs to prevent auth bypass (#38008) (#38015)
    • fix: bound CODEOWNERS regex match time (#38011) (#38025)
    • fix: bound debian ParseControlFile to a single control stanza (#38044) (#38055)
    • fix(deps): update module golang.org/x/net to v0.55.0 security (#37813) (#37829)
  • API
  • BUGFIXES
    • fix: Fix the panic when ssh remote lfs endpoint parsing failure (#38026) (#38158)
    • fix(api): nil pointer panic when filtering tracked times by a non-existent user (#38112) (#38115)
    • fix: keep literal "false" value displayed in workflow_dispatch choice dropdowns (#38080) (#38096)
    • fix: parse HEAD ref (#38119)
    • fix: git cmd (#38084) (#38087)
    • fix(releases): generate notes for initial tag (#37697) (#37986)
    • fix(actions): return 404 when job log blob is missing (#38003) (#38004)
    • fix(actions): exclude workflow_call from workflow trigger detection (#37894) (#37899)
    • fix(actions): keep action run title clickable when commit subject is a URL (#37867) (#37898)
    • fix(actions): reject workflow_dispatch for workflows without that trigger (#37660) (#37895)
    • fix(actions): ack re-sent UpdateLog finalize idempotently (#37885) (#37892)
    • fix: http content file render (#37850) (#37856)
    • fix(issues): clear stale ReviewTypeRequest when submitting pending review (#37809) (#37815)
    • fix: Fix issue target branch selection for non-collaborators (#36916) (#38164)
  • BUILD
    • fix(deps): update @playwright/test to 1.60.0 (#38144)
    • ci: add tools/ci-tools.ts for the PR labeler workflow (#37831)
    • fix(build): swagger css import (#37801) (#37803)