Ethical Hacking News
Gitea has patched a critical RCE vulnerability, allowing ordinary repository writers to plant malicious Git hooks that can run shell commands as the Gitea service account. Upgrading to version 1.27.1 is recommended to fix the bug.
A critical RCE vulnerability (CVE-2026-60004) has been discovered in Gitea versions 1.17 and later before 1.27.1. The vulnerability allows ordinary repository writers to plant malicious Git hooks that can run shell commands as the Gitea service account. The flaw exploits an authentication mechanism in the vulnerable API call, which requires repository write permission to be exploited. Successful exploitation gives the attacker the privileges of the Gitea operating-system account, exposing application and environment secrets. Upgrading to version 1.27.1 fixes the bug and will be automatically applied to Gitea Cloud instances on July 28.
A critical remote code execution (RCE) vulnerability has been discovered in Gitea, a self-hosted Git platform, allowing ordinary repository writers to plant malicious Git hooks that can run shell commands as the Gitea service account. The vulnerability, identified as CVE-2026-60004 with a CVSS score of 9.8, affects Gitea versions 1.17 and later before 1.27.1.
The flaw exploits an authentication mechanism in the vulnerable API call, which requires repository write permission to be exploited. However, Gitea enables registration by default, allowing an outside visitor to create a normal account and repository on an unchanged installation, thus exploiting the bug without requiring pre-existing credentials.
Security researcher Shai Rod, who goes by NightRang3r, reported the vulnerability, and Gitea credits him as the reporter in its advisory. The affected route invokes reqToken(), which rejects requests without a signed-in user, leaving registration open as default. This allows an attacker to create a new repository and then submit the same patch twice, creating an add/add collision that exploits the three-way fallback option.
The bug sits in the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint, which applies a supplied patch inside a shared bare temporary clone. The vulnerable builds invoke git apply with various options, including --index, --recount, --cached, and --binary, adding the -3 three-way fallback option when the server runs Git 2.32 or later.
The PoC signs in with a normal account, creates an initialized private repository, sends the malicious patch twice, and retrieves the command output without needing outbound callback. The hook stores the output in Git objects, creates a branch containing the result, and allows the attacker to fetch it over authenticated smart HTTP.
Successful exploitation gives the attacker the privileges of the Gitea operating-system account, exposing application and environment secrets, mounted repositories, database credentials and contents, OAuth credentials, and reachable internal services. The attack still requires repository write access, Git 2.32 or later, an enabled diffpatch route, and a writable, executable temporary filesystem.
Gitea said that upgrading to version 1.27.1 would fix the bug and automatically upgrade Gitea Cloud instances on July 28. However, some users may need to disable open registration to remove the public account-creation path while the update is deployed but it does not fix the flaw or protect against existing users with repository write access.
Gitea has patched the vulnerability in version 1.27.1 and credits NightRang3r for reporting the bug. The affected versions are 1.17 and later before 1.27.1, while Gitea Cloud instances would be upgraded automatically on July 28.
Related Information:
https://www.ethicalhackingnews.com/articles/New-Gitea-RCE-Lets-Repository-Writers-Plant-a-Git-Hook-to-Run-Shell-Commands-ehn.shtml
https://thehackernews.com/2026/07/new-gitea-rce-lets-repository-writers.html
https://nvd.nist.gov/vuln/detail/CVE-2026-60004
https://www.cvedetails.com/cve/CVE-2026-60004/
Published: Wed Jul 29 04:59:39 2026 by llama3.2 3B Q4_K_M
