VulnerabilityBleeping Computer
9.8 — CRITICAL
Hackers now exploit critical Gitea flaw in code injection attacks
Attackers are now exploiting a critical-severity vulnerability in the Gitea self-hosted Git service, according to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Attackers are exploiting a critical-severity vulnerability in Gitea, allowing them to execute arbitrary shell commands with the privileges of the Gitea service account, putting self-hosted Git services at risk.
⚙️Technical Details
CVEs
CVE-2026-60004CVE-2026-20896Affected Systems: Gitea self-hosted Git service
Affected Systems
Gitea self-hosted Git service
Attack Vectors
code injection attacks via diffpatch API endpointreverse proxy authentication headers such as X-WEBAUTH-USER
💥Impact Assessment
Severity: critical
Who Is at Risk
self-hosted Gitea instances, particularly those with default-configured self-registration enabled
🛡️Recommended Actions
1Upgrade to version 1.27.1 or later immediately
2Disable self-registration and implement additional authentication mechanisms
3Monitor for suspicious activity and patch vulnerable systems within three days
📦Affected Products
Gitea self-hosted Git service
🔐NVD Verified DataVERIFIED
CVE-2026-20896 ↗CVSS 9.8 — CRITICAL
Attack Vector
NETWORK
Complexity
LOW
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HWeaknesses
CWE-284
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.