What Happened
CISA added CVE-2026-60004, a critical code injection flaw in the self-hosted Gitea Git platform rated 9.8 on the CVSS scale, to its Known Exploited Vulnerabilities catalog on August 25, confirming attacks are underway. The flaw lets a user holding ordinary repository write access plant an executable Git hook and run arbitrary shell commands with the privileges of the Gitea service account. Researchers observed an unknown threat actor using the flaw to deploy a cryptocurrency-miner-like dropper on a compromised instance. The risk grows sharper on installations with open self-registration enabled, Gitea’s default setting, since an outside visitor gets the ability to create the account and repository needed to reach the vulnerable code path without any insider access. Gitea developers patched the issue in version 1.27.1, released in late July, weeks before exploitation began. Federal agencies face a remediation deadline of August 28.
Why This Matters for Canadian Organizations
Gitea runs widely across Canadian startups, universities, and mid-sized engineering teams as a lightweight, self-hosted alternative to GitHub and GitLab, often deployed with open registration left on for convenience during setup and never revisited. An attacker gaining code execution on a Gitea service account frequently finds a path to source code, CI/CD secrets, and deployment credentials stored alongside the repositories it hosts. Under the Office of the Superintendent of Financial Institutions’ B-13 guideline, regulated entities bear responsibility for the security posture of self-managed development infrastructure, and under PIPEDA, an intrusion exposing customer data staged through a compromised build pipeline still triggers notification obligations even when the initial entry point sits several steps removed from the data itself.
What to Do
Organizations running self-hosted Gitea should confirm their installation runs version 1.27.1 or later immediately, since a patch has been available for weeks. Administrators should disable open self-registration unless it serves a specific operational need, and audit existing accounts for any created outside expected onboarding channels. Git hook directories deserve a review for unauthorized additions, and any instance showing signs of compromise should have service account credentials and any secrets accessible from the account rotated. Full technical details are available from BleepingComputer and CISA.
