CVE-2026-60004: code injection through the Gitea diffpatch API, and why a forge holds everything

What was fixed

Gitea released version 1.27.1 to address CVE-2026-60004, a code injection flaw in the diffpatch API. The CVSS score is 9.8, and the vector describes a network-reachable, low-complexity issue that requires no privileges and no user interaction. The flaw reached the CISA Known Exploited Vulnerabilities catalog, and the federal remediation deadline was 28 August 2026.

The advisory's impact statement is direct: an attacker able to reach the affected endpoint can execute code in the context of the Gitea service process. No account, session or repository permission is needed to begin.

Why a source forge is a high-value target

The place a defect lands matters more than its score in many cases, and a self-hosted Git service is a concentrated asset. A forge instance holds repository contents, but that is the least interesting part. It also holds deploy keys, personal access tokens, CI/CD secrets referenced by repository configuration, and in many installations the credentials that let build systems pull and push code.

Code execution as the service account therefore reaches beyond reading source. It allows modifying repository content, altering webhook targets so that the next push delivers to an attacker-controlled endpoint, and reading the configuration file that holds the database connection string and signing secrets. In estates where the forge also drives deployments, that access can reach production.

Self-hosted forges are also commonly reachable from the internet. Developers work remotely, and the service is often published directly rather than published behind a VPN, which makes the unauthenticated reachability realistic rather than theoretical.

What to check

• Confirm the running version and compare it against 1.27.1. Forks and downstream distributions that track Gitea source need an equivalent fix review rather than an assumption that an upstream patch applies unchanged.
• Search application logs for requests to the diffpatch endpoint from addresses outside the expected developer population.
• Review repository webhooks and deploy keys for entries that were added or changed in the exposure window.
• Rotate secrets the service could read: database credentials, OAuth application secrets, internal access tokens and any signing keys stored in configuration.
• Restrict the instance to authenticated networks where remote access is not a hard requirement, and place a reverse proxy in front so request paths can be logged and filtered.

The pattern worth carrying forward

Forge software accumulates API surface over time because users ask for automation, and each automation endpoint is another path that must apply the same authentication and authorization checks as the human interface. Injection flaws at that layer share a property: the endpoint accepts structured input that reaches code execution, and the person who wrote it assumed callers had already been authorised elsewhere. Auditing that assumption is more productive than reviewing individual CVE entries as they arrive.

References

• Gitea release and security advisory for CVE-2026-60004
• CISA Known Exploited Vulnerabilities catalog, entry for CVE-2026-60004
• NVD record for CVE-2026-60004