CVE-2026-60004 in Gitea Confirmed Exploited in the Wild
CVE-2026-60004, a vulnerability in Gitea requiring repository write access, is confirmed to be exploited in the wild. Organizations are advised to reassess vulnerabilities immediately.
OffSet7 Newsroom · Reviewed by an OffSet7 analyst · AI-assisted
What happened
CVE-2026-60004 is a vulnerability in Gitea being exploited in the wild.
Who is affected
Gitea environments, especially those with open registration.
Exploited
CVE-2026-60004 is currently being exploited in the wild.
What to do
Organizations should reassess vulnerabilities immediately.
CVE-2026-60004, a vulnerability in Gitea, is confirmed to be exploited in the wild. This vulnerability requires repository write access, which can be more easily obtained in environments with open registration.
The vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, indicating its active exploitation status. This serves as a significant warning sign for organizations using Gitea.
Organizations are advised to reassess their vulnerabilities immediately in response to the confirmed active exploitation of CVE-2026-60004. Ensuring that access controls are properly managed is crucial, especially in environments where open registration is enabled.
