Content Quality: Clear, well-structured News item of about 770 words (within the 400-1200 News range). Leads with the release and the Gitea Blog's own sentence, handles the 21-versus-20 count transparently, gives one section to the review-triggered workflow flaw, one to token-scope and non-token entries, and closes with an explicit 'What the Sources Do Not Say' section. Title is 128 characters (under 150).
Source Verification: Read all five snapshots from sources/2026-11/gitea-2830-.../ (source-0 to source-4, all status 200, no archive fallback, suspicious_patterns null for every source; no injection text found). source-0 (blog.gitea.com 28.3.0, dated November 1, 2026, by bircni/silverwind): confirms the quoted sentence 'contains a large number of security fixes, mostly around token scopes, and bug fixes and performance improvements for Actions, issues, pull requests and packages' and 'We strongly recommend that all users upgrade as soon as possible'; 'third maintenance release for the 28 series'; '60 merged pull requests'; CVE-2026-118386 text (read access, commit_id naming own commit, head branch in same repository, pull_request_review workflows read from that commit and run without approval with secrets and a write token; 'Review-triggered workflows now run on the pull request head. Fixed by #40099 / #40117'; 'Thanks to Anthropic for reporting the issue, and to @silverwind for the patch'); CVE-2026-117635 (public-only token vs admin API: list emails, create private orgs and runner registration tokens, create administrators); CVE-2026-119441 (DELETE /api/v1/orgs/{org}/repos); CVE-2026-112887 (Actions task tokens carry no scope, GITEA_TOKEN lists every private repository via GET /api/v1/user/repos; 'System users now own nothing'); CVE-2026-120263 (ACCOUNT_LINKING = auto, open registration, auto-link only the account the identity's email or user name points to); CVE-2026-113429 (legacy artifact upload, stored XSS); CVE-2026-111943 (Go 1.27.3, intermediate certificates no longer trusted); SQLite index drop; jobs of repositories with Actions disabled not picked up. All verbatim or faithful paraphrase. The blog lists no CVSS/severity scores and no per-CVE affected versions, as the article says. source-1 (GitHub release v28.3.0, dated 2026-11-01): changelog line '(actions) Run review-triggered workflows on the pull request head (#40099) (#40117)' confirmed verbatim as quoted; the page has no CVE list. source-2 (Linuxiac, Bobby Borisov, November 1, 2026): headline 'Gitea 28.3 Released with 20 Security Fixes, Performance Improvements' and subtitle 'addresses 20 security vulnerabilities' confirmed; 'weak enforcement of access token permissions, potentially allowing restricted tokens to access private repository information or perform operations beyond their scope' confirmed; CVE-2026-118386 summary and 'The update changes how these workflows select the commit they run from' confirmed; faster dashboards and repository lists confirmed. The article correctly attributes the 20 to Linuxiac and does not repeat it as fact. source-3 (Gitea Blog 28.2.0): dated October 18, 2026; 'second maintenance release'; contains 12 CVE entries; contains 'security fixes'. source-4 (Linuxiac 28.2): headline 'Gitea 28.2 Fixes Nine Security Vulnerabilities', and 'The developers disclosed 12 vulnerabilities, nine fixed in version 28.2. The remaining three were addressed in earlier releases but are now publicly disclosed' confirmed (consistent with the blog entries for CVE-2026-110324 and CVE-2026-109844 fixed earlier plus a third). Independent-source recount: the only non-Gitea outlet is Linuxiac (two articles = one outlet). Linuxiac is not independent in sourcing: its 28.3 piece closes with 'For more information, visit the official release announcement', carries no reporter verification, quotes no CVE list, and its 28.3 paragraphs track the blog's content; it is a secondary rewrite. Independent sources: 0 truly independent (Gitea blog and GitHub release are the project's own pages; Linuxiac is a derivative secondary outlet). Acceptable for a News item reporting a vendor release whose primary document is the authority, and the article does not claim independent corroboration, but it is the weakest aspect of the piece.
Factual Accuracy: Recounted the Gitea Blog's raw security list: 21 CVE entries, 21 distinct identifiers (grep of unique 'CVE-2026-NNNNNN' at line start = 21; total occurrences in page = 21, no duplicates). The article labels the 21 as the Herald's own tally and notes the blog does not state a count: accurate and well hedged. Linuxiac's 20 is reported as a discrepancy, not resolved by guessing. 'Mostly around token scopes' (the blog's phrase, quoted as the blog's words and used in the headline in the Herald's voice): recounted by category, 21 entries: 10 involve public-only/unscoped token handling directly (117635, 119441, 117685, 118394, 119625, 119627, 116289, 117646, 118395, 114199), plus 112887 (Actions task token without scope) = 11, plus 116474 (job GITEA_TOKEN added email/GPG key to system user; fixed by the same 'Harden context user access scope' change) = 12 token-related; 9 are not (111943 certificates, 120263 account linking, 118386 review workflows [token mentioned only as the resulting capability], 116296 and 118504 archived repository changes, 113429 XSS, 117649 and 119533 private issue/PR visibility, 117677 Helm upload). So 11-12 of 21 (52-57%) is a slim majority; 'mostly' is supported as the blog's characterization and by my recount, though not overwhelmingly. The article itself gives non-token examples. Release date November 1: confirmed by blog date, changelog header and GitHub release. 28.2.0 date October 18 confirmed. 'Review-triggered workflows now run from the pull request head': confirmed by blog and changelog. The article states no severity scores, no exploitation and no per-CVE versions exist in the sources: confirmed (none present; Linuxiac says 'could'/'potentially'). 'The blog does not state which earlier versions each issue affects': accurate (only CVE-2026-118504 mentions 28.2.0 behavior). No claim goes beyond the sources. One omission, not an error: the blog also credits Anthropic for CVE-2026-116474, which the article does not mention; omission does not mislead.
Overall Assessment: Accurate, carefully hedged coverage of a security-heavy Gitea release; every number, CVE identifier, date, quote and PR number checked against the raw snapshots. The 21-vs-20 discrepancy is handled honestly and the Herald's own tally is labelled as such. APPROVE. Featured candidacy: 1 - solid release coverage for self-hosted Git and CI administrators, a defined developer audience, with no evidence of exploitation or broad impact