Critical Alert: CVE-2026–60004 — Pre-Auth Remote Code Execution in Gitea (CVSS 9.8)

A critical security vulnerability identified as CVE-2026–60004 was recently disclosed in Gitea, the popular lightweight self-hosted Git platform. Holding a maximum CVSS v3 score of 9.8 (Critical), this flaw allows unauthenticated remote attackers under default system configurations to achieve full arbitrary code execution (RCE) on the host server.

What Makes CVE-2026–60004 So Severe?

The root cause resides in Gitea's repository patch application routine — specifically exposed through the REST API endpoint:

POST /api/v1/repos/{owner}/{repo}/diffpatch

When handling incoming unified diff patches, Gitea creates temporary bare repositories (git init --bare). When patch conflicts occur, Git's underlying three-way merge fallback strategy forces intermediate files to write out relative to the repository root. Because the temporary clone is bare, its root directory doubles directly as $GIT_DIR.

An attacker can exploit this behavior by forcing a malicious script write into $GIT_DIR/hooks/post-index-change. The moment Gitea runs any subsequent Git operation on that repository, the system automatically executes the injected hook with the host permissions of the Gitea daemon.

The Pre-Auth Factor

While exploiting the endpoint requires repository write privileges, default Gitea installations leave public self-registration enabled without admin approval (DISABLE_REGISTRATION = false). An unauthenticated external actor can simply create an account, spin up a repository, gain write access, and trigger host takeover in minutes.

Immediate Action Required

• Primary Fix: Upgrade all Gitea instances to version 1.27.1 or higher immediately.
• Workaround: If you cannot update right away, set DISABLE_REGISTRATION = true in app.ini to block external account creation.

📖 Read the full technical deep dive, complete with vulnerable code breakdowns, proof-of-concept execution logs, and full mitigation guides on my blog:

👉 Read the Full CVE-2026–60004 Vulnerability Analysis on denizhalil.com