title: CVE-2026-60004 Gitea diffpatch hook patch ACCEPTED with 201 (silent success)
id: 0b562bab-1268-4b76-a361-5b9910ae3db9
status: test
description: >
  The hook-carrying diffpatch request was answered 201 Created. This is the
  wire-visible "it worked" signal, and it exists because of a detail of the bug:
  the exit value of the executed hook is NOT propagated into the diffpatch HTTP
  response, so the API answers a normal 201 Created with a normal commit object
  while the hook has already run as the service account. A 2xx on this URI plus
  this body is therefore the success indicator, not the failure indicator.
  Measured in our A/B: Gitea 1.27.0 answered [201, 201] to the two requests and
  the canary fired; 1.27.1 answered [201, 500] and the canary never appeared in
  22/22 cycles. "[201,201] on a hook-carrying diffpatch" is at once a success
  signal and a vulnerable-version fingerprint. Escalate as a confirmed
  compromise until the host process rules say otherwise.
  Vendor published the exploit in the advisory; no discovery claimed.
author: Xpectra Security Research
date: 2026-08-27
references:
  - https://github.com/go-gitea/gitea/security/advisories/GHSA-rcr6-4jqh-j84m
  - https://nvd.nist.gov/vuln/detail/CVE-2026-60004
logsource:
  category: webserver
  product: gitea
detection:
  uri_ecs:
    url.path|contains: '/diffpatch'
  uri_w3c:
    c-uri|contains: '/diffpatch'
  uri_nginx:
    request_uri|contains: '/diffpatch'
  uri_iis:
    cs-uri-stem|contains: '/diffpatch'
  body_ecs:
    http.request.body.content|contains|all:
      - 'new file mode 100755'
      - 'b/hooks/'
  body_modsec:
    cbody|contains|all:
      - 'new file mode 100755'
      - 'b/hooks/'
  body_generic:
    request_body|contains|all:
      - 'new file mode 100755'
      - 'b/hooks/'
  body_generic2:
    body|contains|all:
      - 'new file mode 100755'
      - 'b/hooks/'
  status_ecs:
    http.response.status_code: 201
  status_w3c:
    cs-status: 201
  status_nginx:
    status: 201
  status_generic:
    status_code: 201
  status_generic2:
    sc-status: 201
  condition: (1 of uri_*) and (1 of body_*) and (1 of status_*)
falsepositives:
  - A patched instance answering 201 to the FIRST patch application (bytes
    accepted, hook never executed). Confirm with the process/file rules - the
    the [201,201] pair - not a single 201 - is the vulnerable-version shape.
level: critical
tags:
  - attack.execution
  - attack.t1059.004
  - cve.2026-60004