Gitea CVE-2026-60004: Exploited RCE via diffpatch API

What to do

1. Check the version (gitea --version or GET /api/v1/version) and upgrade to 1.27.1 or later; current releases are 1.27.3 and 28.2.0.
2. Set DISABLE_REGISTRATION = true in app.ini (or require email confirmation and CAPTCHA) unless public sign-up is essential.
3. Review accounts created recently and their repositories; remove anything you do not recognize.
4. If compromise is possible, rotate app.ini secrets, the database password, OAuth and integration tokens, and any credentials in the Gitea environment.
5. Run Gitea unprivileged in a container with restricted egress, and on Forgejo upgrade to 15.0.9 / 16.0.5 or later.

How to check if you are affected or compromised

• Search Gitea logs for POST /api/v1/repos/<owner>/<repo>/diffpatch, especially repeated calls from accounts registered minutes earlier.
• Look for files at */hooks/post-index-change under Gitea's data and temp directories.
• Look for unexpected branches (e.g. rce-proof) or throwaway repos (e.g. poc-*) created by new accounts.
• Watch for sustained high CPU, unknown processes or outbound downloads from the Gitea service account.

What happened#

On July 27, 2026, Gitea released 1.27.1 with fixes for two CVEs and asked users to "upgrade as soon as possible". The more serious one is CVE-2026-60004, explained the next day in GHSA-rcr6-4jqh-j84m (CVSS 3.1 9.8). Gitea's diffpatch API applies a user-supplied patch inside a temporary bare Git repository. A crafted patch can leave behind an executable Git hook in that repository. Git then runs the hook, giving the attacker shell commands as the Gitea service account. NightRang3r reported the bug, and the published advisory includes a working proof of concept.

The attacker needs only ordinary write access to one repository. The advisory notes that self-registration is open by default, so anyone can sign up, create a repository and attack an instance without any prior credentials.

Who is affected#

Gitea 1.17 through 1.27.0 is affected, per the advisory and the CVE record. The advisory lists three conditions, all common: Git 2.32 or newer on the host, the diffpatch route enabled, and a writable, executable temp directory. Gitea did not ship a 1.26 backport. The last 1.26 release predates the fix, so older installs must move to 1.27.1 or later. Since then Gitea has released 1.27.2 and 1.27.3 and switched to new version numbers, with 28.0.0 through 28.2.0 on its releases page.

Forgejo, the Gitea fork, backported a fix crediting this advisory to its v15 LTS branch in 15.0.6 on July 30 (PR #13705). The same-day v16.0.2 notes do not list it. Forgejo had moved Git hooks to a central location in v16.0, and its notes do not say whether v16 was affected. On September 17, both branches fixed a critical variant in the same patch-application code that also allowed remote code execution (15.0.9 and 16.0.5). Forgejo admins should be on at least those releases. The current releases are 15.0.10 and 16.0.6.

Do you really need to act?#

Yes. A self-hosted Git server holds source code, deploy keys, CI secrets and OAuth tokens, and the advisory warns that app.ini, environment secrets and database credentials may be exposed. CISA added the CVE to KEV on August 25 with a three-day deadline. That day runZero noted evidence of active exploitation.

The clearest public case is an incident write-up on Habr dated August 19. A studio's Gitea 1.24.7 server had open registration with no email confirmation and no CAPTCHA. An automated scanner registered an account, created a private repository, triggered the bug and confirmed code execution as the git user, in about 11 seconds. It then ran a miner-like payload that the host's provider noticed as sustained CPU load. Docker confinement and an unprivileged container limited the damage. Help Net Security notes that no actor has been publicly attributed.

Instances with closed registration and trusted users are at lower risk, but any account with write access, including a compromised one, is enough.

What to do now#

1. Check the version with gitea --version or curl -s https://<host>/api/v1/version, then upgrade to 1.27.1 or later (1.27.3 or 28.2.0 are current) by updating your binary or gitea/gitea image tag.
2. In app.ini, under [service], set DISABLE_REGISTRATION = true. If sign-up must stay open, at least set REGISTER_EMAIL_CONFIRM = true and ENABLE_CAPTCHA = true.
3. Audit users created since late July, and their repositories and branches.
4. If anything looks wrong, rotate the secrets in app.ini, the database password, OAuth and integration tokens, and deploy keys.
5. Run Gitea as an unprivileged container with restricted egress. On Forgejo, upgrade to 15.0.9 or 16.0.5 or later.

How to tell if you were hit#

Search Gitea logs (docker logs gitea, or gitea.log and access.log in the log directory) for POST requests to /api/v1/repos/<owner>/<repo>/diffpatch. Pay most attention to repeated calls seconds after a /user/sign_up and a repository creation from the same client. Look for files named post-index-change under any hooks/ directory in Gitea's data or temp paths. Check for odd branches such as rce-proof and repositories named poc-*, the names seen in the Habr incident. Sustained CPU load, unknown processes or downloads run as the Gitea user are strong signs of compromise. In that case, rebuild the host or container and rotate credentials rather than cleaning up in place.

Timeline#

• Jul 27, 2026 — Gitea 1.27.1 released with the fix.
• Jul 28, 2026 — GitHub advisory with proof of concept published.
• Jul 30, 2026 — Forgejo 15.0.6 backports a fix.
• Aug 19, 2026 — Habr incident report of a cryptominer compromise.
• Aug 25, 2026 — CISA adds CVE-2026-60004 to KEV.
• Aug 26, 2026 — CVE record published.
• Aug 28, 2026 — CISA remediation deadline for federal agencies.
• Sep 17, 2026 — Forgejo 15.0.9 and 16.0.5 fix a critical diffpatch variant.

Vulnerability records

• CVE-2026-60004 · KEV 2026-08-25 · Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Gitea — GHSA-rcr6-4jqh-j84m: Remote Code Execution via diffpatch Git Hook Installation github.com
2. Gitea — Gitea 1.27.1 is released blog.gitea.com
3. CVE record — CVE-2026-60004 cve.org
4. NVD — CVE-2026-60004 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2026-60004 cisa.gov
6. CISA — CISA Adds One Known Exploited Vulnerability to Catalog (Aug 25, 2026) cisa.gov
7. Gitea — Releases github.com
8. Forgejo — PR #13705: fix: disable hooks during diff patch (v15.0) codeberg.org
9. Forgejo — 15.0.9 release notes codeberg.org
10. Habr — Incident report: cryptominer on a self-hosted Gitea via CVE-2026-60004 (Russian) habr.com
11. runZero — Gitea vulnerability CVE-2026-60004: find impacted assets runzero.com

Coverage and analysis

1. Help Net Security — Critical Gitea vulnerability now exploited in the wild (CVE-2026-60004) helpnetsecurity.com