Which Gitea versions are affected by CVE-2026-60004?

Gitea's own security advisory (GHSA-rcr6-4jqh-j84m) states the affected range as versions 1.17 and later, up to but not including 1.27.1 — release lines spanning July 2022 to July 2026. The fix shipped in 1.27.1. Because Gitea does not backport security fixes to older minor lines, no version line before 1.27 will receive a patch for this vulnerability.

Does Gitea have an LTS or long-term support version?

No. Gitea's release-cadence documentation describes a rolling release model rather than long-lived maintenance branches with separate end-of-life dates. A version line remains current until the next one is released and becomes the recommended upgrade path. In practice, patches for a minor line stop when its successor ships — so the only continuously supported position is the newest release line.

Does the CISA KEV deadline apply to my organization?

The binding remediation deadline applies to US federal civilian agencies under CISA's Binding Operational Directive on risk-prioritized patching. For everyone else, a KEV listing is the strongest public signal available that a vulnerability is being exploited in the wild right now — most security programs treat KEV entries as patch-now items regardless of sector.

Gitea's First KEV Entry: CVE-2026-60004, a Two-Day Federal Deadline, and a Release Policy With Nowhere to Hide

Q: What is CVE-2026-60004?

A critical code-injection vulnerability (CWE-94, CVSS 9.8) in Gitea's diffpatch API endpoint. An attacker with repository write access can submit a crafted patch that exploits Git's three-way-merge fallback to plant an executable Git hook, which then runs shell commands as the Gitea service account. CISA added it to the Known Exploited Vulnerabilities catalog on August 25, 2026 with a remediation due date of August 28, 2026. Gitea fixed it in version 1.27.1.

By Scott Bissett · Published August 26, 2026 · Verified against Gitea's security advisory (GHSA-rcr6-4jqh-j84m), Gitea's release-cadence documentation, the go-gitea release record, and CISA's KEV catalog

On August 25, CISA added CVE-2026-60004 to the Known Exploited Vulnerabilities catalog and gave US federal agencies until August 28 — a two-day window, among the shortest the catalog carries. The vulnerability sits in Gitea, the self-hosted Git service that runs source control inside thousands of companies, and the numbers are ugly: CVSS 9.8, code injection (CWE-94), under active exploitation.

The mechanics, from Gitea's own advisory: an attacker with repository write access sends a crafted patch to the diffpatch API endpoint. By exploiting Git's three-way-merge fallback and submitting the same patch twice, they force an add/add collision that checks out an executable file as a live Git hook — which then runs shell commands as the Gitea service account. From there: application secrets, database credentials, every hosted repository, OAuth tokens. On instances with open registration enabled, "repository write access" is something an attacker can simply sign up for.

The lifecycle math in one paragraph: Gitea's advisory states the affected range as 1.17 and later, below 1.27.1 — every release line from July 30, 2022 to mid-2026. The fix exists: 1.27.1, shipped in July. But Gitea has no LTS line, no lifecycle matrix, and no backport commitment — a version line stops receiving patches when its successor ships. So there is no supported older version to retreat to, no extended-support vendor to pay, and no patch coming for any pre-1.27 line, ever. The decision tree has one branch: upgrade to 1.27.1 or later.

Key Dates at a Glance

gitea 1.26: end of life 2026-07-13
gitea 1.25: end of life 2026-04-18
gitea 1.24: end of life 2025-10-29
gitea 1.23: end of life 2025-06-10
gitea 1.22: end of life 2025-01-09
gitea 1.21: end of life 2024-05-27
gitea 1.20: end of life 2023-11-14
gitea 1.17: end of life 2022-12-29

What Gitea's Advisory Actually Says

Verbatim facts from GHSA-rcr6-4jqh-j84m, published in Gitea's own repository:

Severity: Critical — CVSS 9.8
Affected versions: ">=1.17, <1.27.1" — stated by the vendor, not inferred
Patched version: 1.27.1
Attack surface: the diffpatch route, when enabled
Prerequisites: Git 2.32 or newer on the server, a writable and executable temporary filesystem, and repository write access — which open registration hands to anyone
Impact: arbitrary command execution as the Gitea OS user, exposing application secrets, database credentials, mounted repositories, and OAuth tokens
Workarounds: the advisory lists none — upgrading is the fix

Because the patch exists, the honest framing for any pre-1.27.1 install is not "confirmed compromised" — it is that the vendor has told you the range it considers affected and shipped exactly one exit. If your instance is in that range, the question is not whether to move but how fast.

Facing an end-of-life deadline?

Tell us which product and we’ll reply with vetted extended-support options and pricing guidance — free, no obligation. Vendors don’t pay for placement.

The Gitea Support Map

We now track Gitea as a product. Gitea publishes no lifecycle table, so the dates below come from the project's release record on GitHub, and "supported until" models Gitea's stated policy — a line is current until its successor ships:

Release line	First release	Supported until	In CVE-2026-60004 range?	Status
Gitea 1.27	July 13, 2026	Current line	Below 1.27.1 only — fixed from 1.27.1	Supported
Gitea 1.26	April 18, 2026	July 13, 2026	Yes — no patch coming to this line	EOL
Gitea 1.25	October 29, 2025	April 18, 2026	Yes — no patch coming to this line	EOL
Gitea 1.24	June 10, 2025	October 29, 2025	Yes — no patch coming to this line	EOL
Gitea 1.23	January 9, 2025	June 10, 2025	Yes — no patch coming to this line	EOL
Gitea 1.22	May 27, 2024	January 9, 2025	Yes — no patch coming to this line	EOL
Gitea 1.17 – 1.21	July 30, 2022 onward	Each line ended at its successor's release	Yes — no patch coming to these lines	EOL

Every line in that table except 1.27 is inside the vendor's stated affected range and past the point where it receives patches. The live risk picture per line is on the product page — 55 is 1.26's current EOL Risk Score, and the full Gitea page carries the rest.

No LTS Means the Ladder Has One Rung

Gitea's release-cadence documentation is unusually direct about its model: it describes "a rolling release model rather than a broad set of public long-lived maintenance branches with separate end-of-life dates for each version," with a version remaining current "until the next major version is released and becomes the recommended upgrade path."

The release record bears that out. Patches for 1.25 stopped in March 2026; 1.26 arrived in April and its patches stopped in June; 1.27 arrived in July. (Occasionally a final courtesy patch lands days after a successor ships — 1.20 got one — but there is no commitment behind it.) Compare that with products like Jenkins or PostgreSQL, which maintain multiple supported lines in parallel: with Gitea, the moment you are one minor behind, you are on borrowed time, and the moment a CVE like this lands, borrowed time is up.

That model is a legitimate engineering choice for a fast-moving project — but it changes what "we'll patch next quarter" means. For Gitea there is no such thing as staying on 1.24 and taking security fixes. The supported position is the current line, continuously.

What To Do, In Order

Find your version — it's in the footer of your Gitea web UI, or from the API: GET /api/v1/version.
If you're anywhere in 1.17 – 1.27.0: upgrade to 1.27.1 or later. That is the vendor's stated fix, and the advisory lists no workaround. Federal civilian agencies have an August 28 deadline; everyone else should treat a KEV listing as the strongest patch-now signal that exists.
Reduce the prerequisite while you schedule the upgrade: the attack requires repository write access, and open registration hands that to anyone on the internet. If registration is open on an unpatched instance, closing it narrows who can reach the vulnerable path — exposure reduction, not a fix.
After upgrading, rotate what the service account could see if your instance sat exposed with open registration: application secrets, database credentials, OAuth tokens. The advisory is explicit that these are what successful exploitation reaches.

FAQ

What is CVE-2026-60004?

A critical code-injection vulnerability (CWE-94, CVSS 9.8) in Gitea's diffpatch API endpoint. An attacker with repository write access can plant an executable Git hook via a crafted double-submitted patch, then run shell commands as the Gitea service account. CISA added it to the KEV catalog on August 25, 2026 with an August 28 remediation deadline. Fixed in Gitea 1.27.1.

Which Gitea versions are affected?

Gitea's own advisory states the range: 1.17 and later, up to but not including 1.27.1 — four years of release lines. The fix is in 1.27.1. Older lines will not receive backported patches.

Does Gitea have an LTS version I can hold on?

No. Gitea's release-cadence documentation describes a rolling release model with no long-lived maintenance branches and no per-version end-of-life dates. A line is supported until its successor ships. The only continuously supported position is the newest release line.

Does the August 28 deadline apply to me?

The binding deadline applies to US federal civilian agencies. For everyone else it is a signal, not a mandate — but it is the strongest public signal available that this flaw is being exploited right now.