Critical RCE Vulnerability in Gitea (CVE-2026-60004) Exposes Servers to Arbitrary Command Execution A severe remote code execution (RCE) vulnerability, tracked as CVE-2026-60004 (CVSS 9.8), has been discovered in Gitea, affecting versions 1.17 through 1.27.0. The flaw, patched in Gitea 1.27.1, allows attackers to execute arbitrary shell commands on vulnerable servers by exploiting the diffpatch endpoint, which processes repository patches using Git commands. ### Exploitation Mechanism The vulnerability stems from how Gitea handles temporary bare repository clones when applying patches. An attacker with write access to a repository can craft a malicious Git hook (e.g., `hooks/post-index-change`) in the repository root, which Git treats as an executable hook. By submitting a specially crafted patch twice, the attacker triggers Git’s three-way merge fallback (introduced in Git 2.32+), causing the hook to execute during index updates. Key requirements for exploitation include: - Git 2.32 or later installed on the target system. - The diffpatch route enabled in Gitea. - A writable and executable temporary filesystem on the server. Notably, the attack does not require an outbound network connection, as command output can be exfiltrated via Git objects and authenticated Smart HTTP. ### Impact & Risks Successful exploitation grants attackers the ability to run commands under the Gitea service account’s permissions, potentially leading to: - Theft of sensitive data, including `app.ini` configurations, database credentials, OAuth tokens, and environment variables. - Compromise of mounted repositories and integration credentials. - Full server takeover, depending on the service account’s privileges and server isolation. While exploitation requires write access, publicly accessible Gitea instances with open registration are at heightened risk, as unauthenticated users could register an account, create a repository, and trigger the exploit. ### Mitigation & Response Gitea has released version 1.27.1 to address the flaw. Until upgrades are applied, administrators are advised to: - Disable or restrict the diffpatch functionality. - Disable public registration and limit repository write permissions. - Review Gitea service account privileges and enforce least-privilege access. - Monitor Git and Gitea logs for unusual patch submissions or unexpected hook activity. The vulnerability underscores the importance of prompt patching and access controls, particularly for self-hosted Gitea deployments. Recent updates have included multiple security fixes, reinforcing the need for proactive vulnerability management.

Critical Gitea Authentication Bypass Vulnerability Exploited in the Wild Security researchers have confirmed active exploitation of CVE-2026-20896, a severe authentication bypass flaw in Gitea, a widely used code repository management platform. The vulnerability, rated near-perfect in severity, was patched in Gitea versions 1.26.3 and 1.26.4, released on June 21. However, attackers began targeting the flaw just 13 days later, leveraging a single HTTP header to gain unauthorized access. The issue stems from Gitea’s Docker image, which ships with reverse-proxy authentication enabled by default. This configuration causes Gitea to trust any source IP address, allowing unauthenticated attackers to impersonate any user including administrators without requiring a password or token. Michael Clark, Threat Research Director at Sysdig, reported that the first in-the-wild exploitation was detected by Sysdig sensors, originating from a VPN-exit scanner that successfully breached an exposed instance. Once authenticated, attackers can read and modify repository code, as well as extract sensitive data accidentally committed to repositories, such as database credentials, API keys, and deploy tokens. Security researcher Ali Mustafa, who discovered the flaw, explained that the official Docker image hardcodes a wildcard (``) in its configuration, overriding the secure default (which restricts access to loopback IPs). This misconfiguration, combined with reverse-proxy login and auto-registration*, enables attackers to create admin-level accounts simply by sending a crafted header. As of recent scans, Shodan indexed over 6,000 internet-facing Gitea instances, highlighting the potential scale of exposure. Organizations running affected versions are advised to upgrade immediately to the patched releases to mitigate risk.

Critical Gitea Authorization Flaw (CVE-2026-58443) Exposes Private Repositories to Unauthorized Workflow Execution A critical vulnerability in Gitea, tracked as CVE-2026-58443 (CVSS v3.1: Critical), allows attackers to bypass API token restrictions and write to private repositories, potentially triggering unauthorized Actions workflows. Disclosed via GHSA-xxjv-752h-3vp2 and reported by ohxorud-dev, the flaw stems from an incorrect authorization check in Gitea’s pull request update endpoint (`POST /api/v1/repos/{owner}/{repo}/pulls/{index}/update`). The bug occurs because Gitea only validates a token’s public-only restriction against the base repository (public) rather than the head repository (private) involved in the request. When `UpdatePullRequest()` processes the update, it authorizes the head repository via standard RBAC but fails to recheck the token’s scope, enabling server-side pushes to private branches. If Gitea Actions is enabled on the private repository, the unauthorized push triggers workflows as if performed by a legitimate contributor, turning the bypass into a vector for executing private CI/CD pipelines. A proof-of-concept (PoC) demonstrates the attack chain: a public-only token with `write:repository` permissions creates a file in a public repo, opens a pull request from a private branch, and uses the update endpoint to merge public commits into the private branch successfully triggering private workflows. While the flaw does not expose private data (confidentiality remains intact), it constitutes a severe integrity violation (CWE-863: Incorrect Authorization). Exploitation requires a valid public-only token belonging to a user with write access to the private repository, along with an existing pull request linking public and private repos. This limits attacks to scenarios involving token mismanagement or compromised credentials, rather than unauthenticated access. Affected Versions & Mitigation Gitea versions up to and including v1.26.4 are vulnerable. The issue is patched in v1.27.0. Self-hosted instances should upgrade immediately, audit public-only tokens for suspicious pull request activity, and review Actions logs for unauthorized workflow executions. This disclosure follows a series of mid-2026 Gitea advisories, including a reverse-proxy authentication bypass and an SSRF flaw in webhook handling, highlighting recurring scope-boundary failures in route-level authorization checks.