CVE-2026-60004: Gitea Code Injection Vulnerability Allows Remote Command Execution via DiffPatch API
What It Is — Gitea’s diffpatch API endpoint fails to properly validate patches submitted by users with repository‑write access. An attacker can embed a malicious Git hook that runs arbitrary shell commands as the Gitea service account.
Exploitability — No public exploit code has been released, but the vulnerability is exploitable by any attacker who already has write permission to a repository. The NVD assigns a CVSS v3.1 base score of 8.8 (High).
Affected Products — All self‑hosted Gitea installations prior to the vendor‑released fix (versions < 1.22.0).
Why It Matters for Trust & Control Assurance
- Access‑control hygiene – Demonstrates the risk of over‑privileged repository accounts; continuous verification of least‑privilege is a core control evidence point.
- Code‑integrity monitoring – Auditors expect immutable logging of code changes; this flaw bypasses that guarantee, highlighting the need for immutable audit trails.
- Defensible evidence – Remediating and documenting the patch process provides concrete proof of control enforcement for frameworks such as NIST CSF 2.0.
Recommended Actions
- Deploy the vendor patch for CVE‑2026‑60004 without delay.
- Restrict write access to the smallest necessary set of users and enforce MFA for all privileged accounts.
- Enable detailed logging of diffpatch API calls and feed the logs into a SIEM for continuous monitoring.
- Map the finding to your “code‑integrity and repository access” control objective and capture remediation evidence for audit readiness.
Source: CISA KEV – CVE‑2026‑60004