A write permission bug becomes a public code-execution path on unchanged Gitea installs, because default registration lets an outsider create the account and repository needed to reach it. Gitea fixed CVE-2026-60004 in 1.27.1; affected versions are 1.17 through 1.27.0, and the advisory includes public proof-of-concept code. A standard patch-only response misses the access path: if registration stays open, the attacker does not need preexisting credentials.
The flaw sits in the patch-handling flow for repository diffs, where crafted patch content can end up as an active Git hook and run commands as the Gitea service account. The same pattern matters anywhere self-hosted Git leaves signups open or ordinary users can create repositories, because the service assumes writer access is trusted and this bug breaks that assumption.