CVE-2026-60004

Gitea is a server you may use to host code repositories. This bug lets someone reach a specific feature (the diffpatch API) and trick the server into installing a malicious Git hook, which can then make the server run attacker-chosen code. Think of it like giving an intruder a way to “install a new add-on” that runs immediately with the server’s permissions.

This matters if you run Gitea and your version is earlier than 1.27.1. The flaw does not require a login or user action, and attackers can use the internet to reach the affected API (network attack). It is a priority if your Gitea server is exposed so that the diffpatch API can be accessed, and it becomes critical under that reachability condition.

This is RED because confirmed attackers are exploiting CVE-2026-60004 in the real world, and it was added to CISA KEV on 2026-08-25. The weakness enables remote code execution without authentication, so exposed instances can be compromised quickly. Act before the CISA KEV mitigation due date of 2026-08-28.

1. Confirm exposure and version

   • Identify the running Gitea version on the host (and any other Gitea instances you operate).
   • Determine whether each instance is earlier than 1.27.1.

2. Patch as the primary fix (CISA-aligned)

   • Upgrade Gitea to 1.27.1 or later.
   • Use the vendor guidance in the official advisory: https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m

3. If you cannot upgrade immediately (temporary containment)

   • Follow the vendor’s provided mitigations/workarounds from the same advisory.
   • Additionally, restrict network access so the diffpatch API is not reachable from the public internet (for example, allow-list known admin IPs/VPN only, or block access at the reverse proxy/firewall where practical).
   • If you use compensating controls (WAF/reverse proxy rules), verify they actually block requests to the diffpatch API.

4. Incident-style checks (do this even if you plan to patch right away)

   • Search Gitea and application logs for evidence of diffpatch API use that led to hook installation.
   • Check host process lists, scheduled tasks/cron (if applicable), and unusual outbound connections consistent with attacker payloads (articles report crypto-mining in compromised instances).
   • Preserve logs for forensics/triage as advised by CISA’s KEV requirements (referenced by CISA in the KEV entry).

5. Compliance timeline

   • CISA KEV remediation due date: 2026-08-28.
   • If mitigations aren’t available for an exposed asset, CISA guidance indicates discontinuing use of the product until mitigations can be applied.

6. After patching

   • Re-run the version check to confirm the upgrade succeeded.
   • Continue monitoring for suspicious activity for a short period, focusing on signs of newly installed hooks and suspicious processes.

Severity is effectively critical: remote code execution with a very low barrier. The mechanism is unauthenticated access to Gitea’s diffpatch API on versions before 1.27.1, allowing an attacker to install malicious Git hooks, which then execute arbitrary code on the server (CWE-94). Attack vector is network and no authentication or user interaction is required. Exploitation status is confirmed: CISA KEV listing is marked YES with a CISA add date of 2026-08-25 and reported in-the-wild incidents include crypto-mining on self-hosted Gitea instances. Patch status: fixed in Gitea 1.27.1. EPSS indicates high predicted likelihood (noting that KEV/news confirmation takes precedence for urgency). KEV means CISA has identified this as actively exploited and expects prioritization and faster mitigation per its guidance; CISA remediation due date is 2026-08-28.