CVE Feed

    Dashboard / CVE / CVE-2026-60004

    CVE-2026-60004

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Published:Aug 26, 2026
    Last Modified:Aug 27, 2026
    EPS:Aug 26, 2026
    EPSS Score:0.824
    CVSS Score:9.8

    CISA Notification

    Description

    Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.

    Required Action:

    Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

    Notes:

    No extra notes provided.

    Due Date
    Aug 28, 2026
    14 days ago
    Alert Date
    Aug 25, 2026
    17 days ago

    Affected Products

    Vendor
    Gitea
    Product
    Gitea

    Exploits

    https://github.com/0xBlackash/CVE-2026-60004https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84mhttps://github.com/0xBlackash/CVE-2026-60004https://github.com/EQSTLab/CVE-2026-60004https://github.com/fevar54/cve-2026-60004https://github.com/gagaltotal/CVE-2026-60004-poc-giteahttps://github.com/HackSpeak/CVE-2026-60004https://github.com/HORKimhab/CVE-2026-60004https://github.com/imbas007/CVE-2026-60004-POChttps://github.com/InfoSec-DB/CVE-2026-60004-Gitea-RCE-PoChttps://github.com/InfoSec-DB/CVE-2026-60004-Gitea-Validatorhttps://github.com/Sachinart/CVE-2026-60004-gitea-0dayhttps://github.com/shinthink/CVE-2026-60004

    Related CVEs

    CVE-2026-34966 (CVSS 8.3) — Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers…
    CVE-2026-20912 (CVSS 9.1) — Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uplo…
    CVE-2026-20904 (CVSS 6.5) — Gitea does not properly validate ownership when toggling OpenID URI visibility. An authenticated user may be a…
    CVE-2026-20888 (CVSS 4.3) — Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A use…
    CVE-2026-20897 (CVSS 9.1) — Gitea does not properly validate repository ownership when deleting Git LFS locks. A user with write access to…
    CVE-2026-20800 (CVSS 6.5) — Gitea's notification API does not re-validate repository access permissions when returning notification detail…
    CVE-2026-20883 (CVSS 6.5) — Gitea's stopwatch API does not re-validate repository access permissions. After a user's access to a private r…
    CVE-2026-0798 (CVSS 3.5) — Gitea may send release notification emails for private repositories to users whose access has been revoked. Wh…
    CVE-2026-20750 (CVSS 9.1) — Gitea does not properly validate project ownership in organization project operations. A user with project wri…
    CVE-2026-20736 (CVSS 7.5) — Gitea does not properly verify repository context when deleting attachments. A user who previously uploaded an…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High