CVE-2026-60004 in Gitea added to CISA KEV catalog

Gitea 1.17.0 through 1.27.0 is affected by a code injection flaw rated CVSS 9.8: an attacker with repository write access can execute a hook on the host via the diffpatch endpoint. CISA added CVE-2026-60004 to its Known Exploited Vulnerabilities catalog on August 25, 2026; the fix ships in Gitea 1.27.1.

• Gitea 1.17.0–1.27.0 affected, fixed in 1.27.1
• CVSS 9.8, CWE-94, hook runs as the Gitea OS user
• CISA added the CVE to KEV on August 25, 2026
• ZoomEye returned 117,536 matches for app="Gitea" on October 30, 2026