The chain runs from a public signup form to a shell in four steps. An attacker loads the registration page on any instance that kept the shipped default [5], creates an account, creates a repository, and thereby holds the ordinary write access the bug requires [4]. Then a patch goes to the diffpatch endpoint. Gitea's security team says that endpoint can be abused to install and execute a Git hook from repository-controlled content, and the hook runs shell commands as the Gitea OS user [6].
Gitea shipped 1.27.1 on July 27 for the flaw, which Salesforce security researcher Shai Rod reported [7][3]. Shadowserver's vulnerable count is dated August 27 [1]. That is 31 days of patch availability measured against 8,393 hosts still answering [1]. CISA's deadline for Federal Civilian Executive Branch agencies is August 28, one day after that scan, and the three-day window comes from BOD 26-04, which binds federal civilian agencies and nobody else [2][9]. The other operators in the 8,393 have no such deadline.
Gitea reports more than 400,000 installations [12]. The vulnerable figure is roughly 2 percent of that [3], but the two numbers are not the same measurement: Shadowserver counts internet-facing IPs that answer a scan [1]. An install behind a VPN with signup disabled never enters the population, so read 8,393 as exposed-and-vulnerable, not as a share of the fleet.
The advisory language says authenticated [2]. On a default install that qualifier describes nothing useful about who can reach the endpoint [5]. It does still matter on a locked-down instance, where the precondition is ordinary write access to any repository on the box [6], the level a contractor account or a stale integration token already has.
This is the second route into self-hosted Gitea worked in two months. In July, threat actors were seen abusing CVE-2026-20896, an authentication bypass in the official Gitea Docker image affecting instances with reverse proxy authentication headers enabled [11]. The payload reported on CVE-2026-60004 so far is cryptocurrency mining malware [10], installed by whichever attackers got there first; that says nothing about the ceiling on command execution as the account that serves the repositories.
Exposure here has two variables: the version the box runs, and whether a stranger can still create an account on it. A patch report shows only the first.
