Shadowserver counted 8,393 internet-facing Gitea instances still vulnerable to CVE-2026-60004 on 27 August 2026.

The fix shipped in 1.27.1 on 27 July. That is a month.

The word doing the damage is "authenticated"

The vulnerability is a code injection reachable through the diffpatch API endpoint. In the researchers' description, an attacker with ordinary write access to a repository can execute arbitrary shell commands as the Gitea OS user.

Read on its own, that is a post-authentication bug, and post-authentication bugs get triaged accordingly — you need an account, so the blast radius is your own users.

Then read the next sentence: with default open registration, an unauthenticated visitor can obtain the required write access by registering an account and creating a repository.

Registration is open by default. So the precondition is: be a person with a web browser.

Why this keeps happening

"Authenticated" is doing two different jobs in security advisories, and only one of them is honest.

Where obtaining an account is genuinely hard — an internal system, an approved-domain SSO, an invite — it meaningfully reduces exposure. Where the product ships a public sign-up form, it reduces nothing, and describing the flaw as authenticated actively misleads the person deciding what to patch this week.

The same thing happens in the GiveWP donation plugin patched this week, where an unauthenticated registration action creates accounts even on sites that turned registration off. Different product, same category error: the barrier that makes "authenticated" meaningful was never there.

This site made the same point about Citrix describing an unauthenticated RCE as a denial-of-service issue. The engineering was fine in all three cases. The sentence was the problem.

What is being done with it

Attackers are deploying cryptocurrency mining malware on unpatched servers.

That is worth sitting with rather than dismissing as low-severity. Mining is what you deploy when you have code execution and no better idea yet — it monetises access immediately while costing nothing to abandon. The access itself is the same access that would let someone modify a repository, and a Gitea instance holds an organisation's source code and CI credentials.

Nobody has reported the second thing yet. That does not mean the first is the ceiling.

CISA added the flaw to its Known Exploited Vulnerabilities catalog on 26 August, with a federal deadline of 28 August — three days, which is now the routine interval for this catalog.

What to do

  • Upgrade to 1.27.1 or later. It has been available since 27 July.
  • Turn off open registration unless you have a specific reason for it. This is the setting that converts an authenticated flaw into an internet-facing one.
  • Check for miners — sustained CPU on a git server is not subtle, and it is the observed payload.
  • Then check the repositories, not just the host. Code execution as the Gitea user is code execution over what Gitea stores.
  • Rotate CI tokens and deploy keys held on the instance if you find anything.
  • Get it off the public internet. Self-hosted git is usually reachable because it was easier, not because it needed to be.

What is not established

  • The CVSS score. Not published.
  • Who is exploiting it. No attribution.
  • How many of the 8,393 have been compromised, as distinct from being vulnerable.
  • Whether anything beyond mining has been deployed.