Threat Overview
CVE-2026-60004 is a critical code-injection vulnerability in self-hosted Gitea. A user with repository write access can submit a crafted patch to the diffpatch API so that a Git hook is written into a temporary bare repository and executed as the Gitea service account. CISA added the flaw to the Known Exploited Vulnerabilities catalog on August 25, 2026, confirming exploitation in the wild.
The practical attack surface is larger where self-registration is enabled because an external attacker may be able to create an account and repository, obtain the required write access, and reach the vulnerable endpoint without prior organizational credentials.
References
- BleepingComputer — August 26, 2026
- Canadian Centre for Cyber Security — August 25, 2026
- CISA Known Exploited Vulnerabilities Catalog
Impacted Systems
| Vendor / Product | Gitea self-hosted Git service |
| Affected versions | Gitea 1.17 through 1.27.0; versions prior to 1.27.1 should be treated as affected |
| Fixed version | 1.27.1 or later |
| Component | POST /api/v1/repos/{owner}/{repo}/diffpatch |
| Required attacker access | Repository write access |
| Higher-risk exposure | Internet-facing Gitea with open self-registration and repository creation enabled |
| Cloud / SaaS applicability | Self-hosted Gitea; not GitHub or GitLab SaaS |
What this hunt looks for
Looks for POST requests to the vulnerable Gitea diffpatch API and post-exploitation behavior such as shell, scripting, downloader, or unexpected outbound activity initiated by Gitea or Git processes.
Required logs
CommonSecurityLog with Gitea, reverse-proxy, or WAF HTTP request telemetry; DeviceProcessEvents; and DeviceNetworkEvents.
First-Pass — Suspicious diffpatch Requests
CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where RequestMethod =~ "POST"
| where RequestURL has "/api/v1/repos/"
| where RequestURL has "/diffpatch"
| summarize Requests=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), UserAgents=make_set(RequestClientApplication, 20) by SourceIP, DestinationHostName, RequestURL
| sort by Requests descFollow-Up — Shells Spawned by Gitea
DeviceProcessEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("gitea", "gitea.exe", "git", "git.exe")
| where FileName in~ ("sh", "bash", "dash", "cmd.exe", "powershell.exe", "pwsh.exe", "curl", "wget", "python", "python.exe")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, SHA256
| sort by TimeGenerated ascFollow-Up — Unexpected Network Activity From Gitea / Git
DeviceNetworkEvents
| where TimeGenerated >= ago(30d)
| where InitiatingProcessFileName in~ ("gitea", "gitea.exe", "git", "git.exe", "sh", "bash")
| where RemoteIPType == "Public"
| summarize Connections=count(), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), RemoteIPs=make_set(RemoteIP,20), RemotePorts=make_set(RemotePort,20) by DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl
| sort by Connections asc
Killian Sherer 