Default self-registration hands unauthenticated attackers Gitea's exploited RCE on 8,393 servers

The chain runs from a public signup form to a shell in four steps. An attacker loads the registration page on any instance that kept the shipped default ^[3], creates an account, creates a repository, and thereby holds the ordinary write access the bug requires ^[2]. Then a patch goes to the diffpatch endpoint. Gitea's security team says that endpoint can be abused to install and execute a Git hook from repository-controlled content, and the hook runs shell commands as the Gitea OS user ^[4].

Gitea shipped 1.27.1 on July 27 for the flaw, which Salesforce security researcher Shai Rod reported ^[5][7]. Shadowserver's vulnerable count is dated August 27 ^[14]. That is 31 days of patch availability measured against 8,393 hosts still answering ^[10]. CISA's deadline for Federal Civilian Executive Branch agencies is August 28, one day after that scan, and the three-day window comes from BOD 26-04, which binds federal civilian agencies and nobody else ^[11][6]. The other operators in the 8,393 have no such deadline.

Gitea reports more than 400,000 installations ^[9]. The vulnerable figure is roughly 2 percent of that ^[12], but the two numbers are not the same measurement: Shadowserver counts internet-facing IPs that answer a scan ^[14]. An install behind a VPN with signup disabled never enters the population, so read 8,393 as exposed-and-vulnerable, not as a share of the fleet.

The advisory language says authenticated ^[1]. On a default install that qualifier describes nothing useful about who can reach the endpoint ^[3]. It does still matter on a locked-down instance, where the precondition is ordinary write access to any repository on the box ^[4], the level a contractor account or a stale integration token already has.

This is the second route into self-hosted Gitea worked in two months. In July, threat actors were seen abusing CVE-2026-20896, an authentication bypass in the official Gitea Docker image affecting instances with reverse proxy authentication headers enabled ^[8]. The payload reported on CVE-2026-60004 so far is cryptocurrency mining malware ^[13], installed by whichever attackers got there first; that says nothing about the ceiling on command execution as the account that serves the repositories.

Exposure here has two variables: the version the box runs, and whether a stranger can still create an account on it. A patch report shows only the first.