Thousands of Gitea Servers Exposed to Critical Code‑Execution Flaw

What’s happening

Shadowserver counted over 8,300 Internet‑exposed Gitea installations still running vulnerable code as of 27 August 2026. The flaw in question, CVE‑2026‑60004, lets an attacker who has logged in run arbitrary shell commands through the diffpatch API.

Technical specifics

CVE‑2026‑60004 is a classic code‑injection vector: the diffpatch endpoint parses user‑supplied data without proper sanitisation, then hands it off to the underlying shell. An authenticated user can therefore execute any command the Gitea process can run.

Gitea 1.27.1, released on 27 July 2026, contains the fix. The patch tightens input handling and adds a guard that rejects malformed diffpatch payloads.

In parallel, threat actors have been exploiting CVE‑2026‑20896, an authentication‑bypass bug in the official Gitea Docker image, to spin up fresh containers with full admin rights. The two vulnerabilities together widen the attack surface for poorly configured deployments.

Who’s at risk

Any organization that hosts a public Gitea instance and has left the default self‑registration setting enabled is effectively handing a door to unauthenticated users. Once an account is created, the attacker only needs valid credentials – which may be harvested elsewhere – to hit the diffpatch endpoint.

U.S. federal civilian agencies are explicitly targeted by CISA’s Binding Operational Directive 26‑04, which mandates patching by 28 August. Private enterprises, research labs, and hobbyist servers are not exempt; the exposure is internet‑wide.

What to do now

1. Upgrade every Gitea deployment to version 1.27.1 or later immediately.
2. If upgrading is delayed, block the /api/v1/diffpatch path at the perimeter firewall or reverse‑proxy.
3. Disable self‑registration in app.ini unless you have a strong account‑creation workflow.
4. Audit existing accounts for suspicious activity; force password resets for any that were created after the vulnerability’s disclosure.
5. Monitor logs for calls to the diffpatch endpoint and for unexpected shell‑command execution traces.
6. Apply the same hardening steps to any Gitea Docker images, ensuring the image version is patched against CVE‑2026‑20896.