Exploiting Gitea Code Injection Vulnerability (CVE-2026-60004) in Phishing Attacks

The discovery of the CVE-2026-60004 vulnerability in Gitea has presented a formidable tool for threat actors looking to escalate their phishing campaigns. This code injection flaw allows unauthorized execution of shell commands, posing a significant threat to unsuspecting developers and organizations utilizing Gitea for version control.

Reports indicate that phishing campaigns leveraging this vulnerability began surfacing in early 2026. These campaigns targeted both public and private repositories, aiming to execute unauthorized code and alter repository content. Given Gitea’s popularity in self-hosted environments, the impact is considerable, with potential exposure expanding across developer and IT personnel.

How It Was Built

The malicious actors constructed the infrastructure carefully to exploit this vulnerability via phishing emails designed to appear as legitimate notifications from Gitea. The delivery mechanism utilized carefully spoofed sender addresses like “no-reply@git-notifications.com” to mimic trustworthy communications.

Phishing emails carried enticing subjects such as “[Action Required] New Repository Feature Access”. The email body included a link to what appeared to be a Gitea repository update page but redirected the victim to a compromised Gitea instance.

Subject: [Action Required] New Repository Feature Access 

From: no-reply@git-notifications.com 

To: user@targetedcompany.com 

Content-Type: text/html; charset=UTF-8 

Dear User,

We have introduced a new feature that requires your immediate attention. Please log in with your credential to proceed.

<a href="http://malicious.git-update.com/login">Access Repository Update</a>

Best Regards, 

The Gitea Team

The payload involved JavaScript-based code injection directly targeting Gitea’s API functionality. Once the user was lured to the malicious site, their credentials were harvested, facilitating further exploitation including unauthorized command execution.

Why It Worked

Several factors contributed to the effectiveness of this campaign. Firstly, the authenticity of the sender address fooled many into believing the communication was legitimate. By mirroring genuine Gitea email structures, the attackers capitalized on trust and familiarity.

Second, the choice of an enticing subject line prompted immediate action from the recipients. The promise of “new features” is a universally appealing hook that plays on the eagerness to utilize the latest tools.

Finally, leveraging an existing vulnerability in Gitea’s API was key. The built-in susceptibility to code injection meant that once credentials were obtained, the adversaries could execute commands without alerting the compromised environment.

Operator Takeaways

As a red teamer, you can draw valuable insights from this campaign to enhance your own engagements. Understanding the strategic choice of sender addresses and the crafting of genuinely convincing lures is critical. Additionally, focusing on vulnerabilities like CVE-2026-60004 provides an effective entry point for simulated attacks, mirroring realistic threat actor techniques.

Integrate similar infrastructure setup, ensuring your communication resembles authentic sources your target frequently interacts with. This kind of approach increases the likelihood of engagement.

Good / Better / Best

Good: Use legitimate-looking sender email addresses and familiar language in communication to reduce suspicion.

Better: Incorporate current topical elements that are specific to the target’s usage of the vulnerable system (e.g., new feature roll-outs).

Best: Develop an end-to-end exploit that leverages the known vulnerabilities in the target’s systems. Deploy payloads stealthily to mimic similar successful attacks observed in the wild.

References

CISA: Known Exploited Vulnerabilities Catalog

NIST: CVE-2026-60004 Gitea Vulnerability