Gitea's diffpatch Endpoint Turns Any Repo Writer Into Root: Patch It Today, CVE-2026-60004 Is on KEV
A Git hook planted through Gitea's diffpatch endpoint gives unauthenticated attackers RCE as the Gitea service account. ~5,000 instances are exposed and the KEV due date is today.
Critical severity, 4 of 4. Act now — exploited, or trivially exploitable on an exposed service.CVSS 9.8Exploited in the wildKEV due 28 AUG 2026CVE-2026-60004
giteaself-hostedrce