A critical flaw in the self-hosted Git platform Gitea let anyone with standard repository write rights convert attacker-supplied patch data into an active git hook. The bug carries the identifier CVE-2026-60004, carries a 9.8 CVSS rating, and hits Gitea releases from 1.17 up to but not including 1.27.1, where the fix landed.
The flaw sits in the diffpatch API endpoint. Vulnerable builds apply a supplied patch inside a shared bare temporary clone, and an attacker can submit the same patch twice to create an add/add collision. The three-way fallback then checks out an executable file placed at hooks/post-index-change, which lands in the git hook directory and runs while the index updates.
Exploitation requires authentication and repository write permission, but Gitea enables open registration by default, so an outside visitor can create an account and a repository on an unchanged installation and exploit the bug without existing credentials. Gitea Cloud instances were upgraded automatically.
Successful exploitation grants the privileges of the Gitea operating-system account, which could expose application secrets, mounted repositories, database credentials, and OAuth tokens depending on isolation. Gitea’s advisory ships with public proof-of-concept code; no in-the-wild exploitation has been confirmed. Administrators should move to 1.27.1 and can temporarily switch off open registration while they roll out the patch.
