Developer docs
API playgroundTry for free, no card

Search company profiles

Gitea

Full company profile

uuid0009ltq

Namestring
Gitea
Legal namestring
CommitGo, Inc.
Websiteurl
gitea.com
Company typeenum
Private
Founded yearint
2016
Operating statusenum
Operating
Ownership categoryenum
Headcount rangeband
1–10
akta.pro rankint
HeadquartersNot publicly disclosed, United States
HQ citystring
Not publicly disclosed
HQ countrystring
United States
HQ regionstring
North America
Markets served

Serves global market

Offices1 record

Each record includes

City, Country, Type, Description, Source

Keyword5 values
self-hosted Git platform, DevOps platform, code hosting, CI/CD pipelines, package registry
Industry3 codes
1Developer Tools & DevOps Platform Services (CI/CD, Artifacts, IaC)
CodeHDABAAAIPrimaryYes
2GitOps & Continuous Delivery Operations
CodeBPAEAKANPrimaryNo
3Open-Source & Developer Communities
CodeBPAMABAMPrimaryNo
NAICS code3 codes
  • Software Publishers513210
  • Software Publishers5132
  • Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services5182
SIC code2 codes
  • Services-Prepackaged Software7372
  • Services-Computer Programming, Data Processing, Etc.7370
Product category
DevOps Platform
GTM motion2 records

Each record includes

Type, Description, Source

Revenue model2 records
1Open Source (Free Tier)
TypeFreemium
Description

Free self-hosted Git service under MIT license with unlimited users and repositories. No revenue generated directly from this tier.

about.gitea.com
2Enterprise Subscription
TypeSubscription Recurring
Description

Paid tier at $9.5-$19/user/month with SAML SSO, audit logs, Kubernetes AutoScaling Runners, priority support with SLA, and emergency telephone support. Requires 1-year commitment.

about.gitea.com
Marketing channels7 records

Each record includes

Title, Type, Stage, Description, Source

Distribution channels6 records

Each record includes

Title, Type, Scope, Target buyer, Description, Source

Cost components5 values
Technology or R&D, Personnel, Infrastructure, Operations, Marketing or Sales
Pricing details2 tiers
1Open Source - Free self-hosted Git service under MIT license
ModelFreemiumBilling cadenceOthers
Notes

Free with unlimited users and repositories. Includes code hosting, issue tracking, pull requests, project management, Gitea Actions CI/CD, packages, rapid updates, and community support.

about.gitea.com
2Enterprise - Dedicated support and infrastructure with enhanced features
ModelPer seatBilling cadenceAnnual
Notes

$9.5-$19/user/month. Includes everything in Free tier plus SAML SSO Integration, Audit Logs, Kubernetes AutoScaling Runners, priority security bug fix notifications, priority email and online support with SLA, and Installation/Upgrade Assistant Service.

about.gitea.com
GTM typeB2B
B2B
Offering typeSoftware
Software
Brand1 of 4 records shown
1Gitea Cloud
Description

Fully managed Gitea, ready in minutes with 30-day free trial

about.gitea.com
+3 more records
Core offering1 text field

Gitea provides a self-hosted DevOps platform offering Git-based code hosting, integrated CI/CD through Gitea Actions (compatible with GitHub Actions), issue tracking, project management, and a package registry supporting 20+ formats. The platform is available as a free MIT-licensed open-source self-hosted product, a paid Gitea Enterprise self-hosted tier with SAML SSO and audit logs, and Gitea Cloud as a fully managed SaaS.

Differentiator
Functional benefit
Problem solved
Quantifiable outcome1 of 3 values shown
  • 277M+ Docker pulls demonstrate widespread production deployment
+2 more records
Product overview1 text field

Gitea is a unified DevOps platform offering both cloud-hosted and self-hosted deployment options. The product portfolio includes Gitea Cloud (fully managed SaaS), Gitea Enterprise (enhanced self-hosted with enterprise features like SAML SSO and audit logs), Gitea Open Source (free MIT-licensed self-hosted platform), Gitea Runner (CI/CD execution agent), and Tea CLI (command-line interface). The core platform integrates code hosting, CI/CD via Gitea Actions, issue tracking, project management, and package registry into a single solution that can be deployed anywhere.

Product and service5 records
1Gitea Cloud
CategoryCloud Service
Description

Fully managed cloud-hosted version of Gitea providing teams a ready-to-use DevOps platform without operational overhead. Includes code hosting, issue tracking, CI/CD via Gitea Actions, and package registry managed by CommitGo.

2Gitea Enterprise
CategoryEnterprise Software
Description

Enhanced self-hosted version for organizations requiring enterprise features including SAML SSO integration, audit logs, Kubernetes AutoScaling Runners, priority security notifications, SLA-backed support, and installation/upgrade assistance.

3Gitea (Open Source)
CategoryCore Product
Description

Free, open-source self-hosted Git platform under MIT license providing code hosting, issue tracking, pull requests, project management, integrated CI/CD via Gitea Actions, and a package registry with no user or repository limits.

4Gitea Runner
CategoryAdd-on Module
Description

Self-hosted runner for Gitea Actions CI/CD that executes automated build, test, and deployment workflows with autoscaling support in Kubernetes environments for enterprise workloads.

5Tea CLI
CategoryDeveloper Tool
Description

Command-line interface tool for interacting with Gitea servers, enabling management of issues, pull requests, releases, and repository operations directly from the terminal.

Scale indicator8 records

Each record includes

Type, Value, Description, Source

Partnership3 partners
Strategic tierCoreTypeTechnology or Integration
Description

Gitea Actions is closely compatible with GitHub Actions, allowing users to reuse existing workflows and over 20,000 existing GitHub Actions plugins. This compatibility is a key differentiator enabling easy migration from GitHub.

Strategic tierCoreTypeTechnology or Integration
Description

Gitea supports Kubernetes deployment via official Helm charts and includes Kubernetes AutoScaling Runners for enterprise CI/CD workloads.

Strategic tierCoreTypeStrategic or Co-development Partner
Description

CommitGo, Inc. provides commercial leadership and support for Gitea. They manage enterprise offerings, cloud services, and product development direction while maintaining the open-source project's governance.

Recent move6 records

Each record includes

Date, Type, Title, Description, Source

Expansion highlight5 records

Each record includes

Type, Description

Peers10 records
TypeEmerging player
Description

Sourcegraph is a code intelligence and search platform that integrates with multiple Git hosts including Gitea, GitHub, and GitLab. It is an adjacent peer serving enterprise developer productivity and code-search needs that complement Gitea's repository hosting layer.

TypeDirect peer
Description

GitLab is the most direct competitor: an end-to-end DevOps platform offering self-hosted and SaaS Git hosting with CI/CD, issue tracking, package registry, and security scanning. Gitea competes most directly with GitLab's self-hosted Community Edition and premium tiers, often positioning itself as a lighter-weight alternative.

TypeEmerging player
Description

Phabricator (and its fork Phorge) is an open-source software development platform with code review, repository hosting, and project management capabilities. It is an adjacent open-source, self-hosted DevOps alternative serving a similar developer audience.

TypeBroad incumbent
Description

Bitbucket (Atlassian) is an established Git hosting platform with both cloud and self-hosted (Data Center) deployment options, integrated with Jira. Competes with Gitea Enterprise for self-hosted enterprise Git and CI/CD workloads, particularly in Atlassian-centric shops.

TypeEmerging player
Description

RhodeCode is a self-hosted source code management platform with Mercurial and Git support, code review, and enterprise security features. It is an emerging player targeting the same self-hosted enterprise DevOps segment that Gitea addresses with Gitea Enterprise.

TypeBroad incumbent
Description

GitHub (Microsoft) is the dominant Git hosting and DevOps platform and the primary competitor Gitea targets for self-hosted migration. Gitea explicitly leverages GitHub Actions compatibility as a wedge to pull users off GitHub into self-hosted environments.

TypeDirect peer
Description

Forgejo is a soft-fork of Gitea created in late 2022 to provide a community-governed alternative after concerns about commercial direction under CommitGo. It is a direct functional peer with overlapping self-hosted Git, CI/CD, and package registry features and a similar target audience.

8Azure DevOps (Repos)
TypeBroad incumbent
Description

Microsoft Azure DevOps includes Git repositories, pipelines, package management, and boards as part of a broader DevOps suite. It is a broad incumbent that competes with Gitea for enterprise self-hosted and cloud DevOps workloads, particularly in Microsoft-centric IT environments.

TypeEmerging player
Description

OneDev is an open-source, self-hosted DevOps platform offering Git hosting, CI/CD, Kanban, and package management. It is a niche emerging player competing for the same self-hosted DevOps workloads, often positioned against Gitea in self-hosted CI/CD comparisons.

TypeBroad incumbent
Description

AWS CodeCommit is Amazon's hosted Git service integrated with the broader AWS developer toolchain. It overlaps with Gitea Cloud as a managed Git hosting option and competes for cloud-first enterprises already on AWS infrastructure.

Market position
Strengths5 records

Each record includes

Headline, Details, Source

Weaknesses5 records

Each record includes

Headline, Details, Source

Competitive moat5 records

Each record includes

Type, Details

Key risks6 records

Each record includes

Headline, Details, Source

Key highlights7 records

Each record includes

Headline, Details, Source

Customer concentration

Classification, Details

Named customers5 records

Each record includes

Name, Industry, Type, Use case, Source, UUID

Segment4 records

Each record includes

Title, Type, Primary, Description, Pain point addressed, Use case, Source

Ideal customer profile4 records

Each record includes

Profile, Firmographic size, Sales motion, Sales cycle length, Buying structure, Purchase trigger, Buyer persona, Geography, Industry vertical, Primary use case, Description, Pain points, Evidence proof points, Target buyer

Technology focused
Yes
API detail
Has APIbool
Yes

Docs URL, Description

Integration14 records

Each record includes

Title, Type, Description, Source

AI maturity
App detail

Has app

Feature5 records

Each record includes

Title, Differentiator, Description, Source

Core technology
Revenue estimate
Valuation estimate
Number of profiles
No data
Compliance1 record

Each record includes

Name, Class, Description

Funding overview

Funding stage, Last funding date, Total funding USD

Funding rounds1 record

Each record includes

Round, Amount USD, Date, Pre money valuation, Total investors, Investors, News

Investors1 record

Each record includes

Name, Type, Date of entry, Rounds participated, Website

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Each record includes

Name, Acquisition type, Announced date, Completed date, Status, Website, News

Investment

Each record includes

Name, Round, Announced date, Lead investor, Website, News

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Gitea

DevOps Platformgitea.com

Gitea firmographics

Firmographics
Name
Gitea
Legal name
CommitGo, Inc.
Website
https://gitea.com
Company type
Private
Founded year
2016
Operating status
Operating
Headcount range
1–10 employees
Ownership category
akta.pro rank

Gitea industry classification

Industry
Product category
DevOps Platform
NAICS
Software Publishers (513210), Software Publishers (5132), Computing Infrastructure Providers, Data Processing, Web Hosting, and Related Services (5182)
SIC
Services-Prepackaged Software (7372), Services-Computer Programming, Data Processing, Etc. (7370)
akta.pro primary industry
Developer Tools & DevOps Platform Services (CI/CD, Artifacts, IaC) (HDABAAAI)
akta.pro secondary industries
GitOps & Continuous Delivery Operations (BPAEAKAN), Open-Source & Developer Communities (BPAMABAM)

Keywords

  • Self-hosted Git platform
  • DevOps platform
  • Code hosting
  • CI/CD pipelines
  • Package registry

Where Gitea is headquartered

Location

Headquarters

HQ city
Not publicly disclosed
HQ country
United States
HQ region
North America

Offices1 record

Markets served

Gitea business model

Business model
GTM type
B2B
Offering type
Software
Cost components
Technology or R&D, Personnel, Infrastructure, Operations, Marketing or Sales

Revenue model

  1. Open Source (Free Tier): Free self-hosted Git service under MIT license with unlimited users and repositories. No revenue generated directly from this tier.
  2. Enterprise Subscription: Paid tier at $9.5-$19/user/month with SAML SSO, audit logs, Kubernetes AutoScaling Runners, priority support with SLA, and emergency telephone support. Requires 1-year commitment.

Pricing tiers

ModelBillingPrice
FreemiumOthersOpen Source - Free self-hosted Git service under MIT license
Per seatAnnualEnterprise - Dedicated support and infrastructure with enhanced features

Go-to-market motion2 records

Distribution channels6 records

Marketing channels7 records

Gitea product offering

Product offering

Core offering

Gitea provides a self-hosted DevOps platform offering Git-based code hosting, integrated CI/CD through Gitea Actions (compatible with GitHub Actions), issue tracking, project management, and a package registry supporting 20+ formats. The platform is available as a free MIT-licensed open-source self-hosted product, a paid Gitea Enterprise self-hosted tier with SAML SSO and audit logs, and Gitea Cloud as a fully managed SaaS.

Product overview

Gitea is a unified DevOps platform offering both cloud-hosted and self-hosted deployment options. The product portfolio includes Gitea Cloud (fully managed SaaS), Gitea Enterprise (enhanced self-hosted with enterprise features like SAML SSO and audit logs), Gitea Open Source (free MIT-licensed self-hosted platform), Gitea Runner (CI/CD execution agent), and Tea CLI (command-line interface). The core platform integrates code hosting, CI/CD via Gitea Actions, issue tracking, project management, and package registry into a single solution that can be deployed anywhere.

Differentiator

Problem solved

Functional benefit

Brands

  • Gitea Cloud: Fully managed Gitea, ready in minutes with 30-day free trial
  • Gitea Enterprise
  • Gitea Runner
  • Tea CLI

Products and services

  • Gitea Cloud Fully managed cloud-hosted version of Gitea providing teams a ready-to-use DevOps platform without operational overhead. Includes code hosting, issue tracking, CI/CD via Gitea Actions, and package registry managed by CommitGo.
  • Gitea Enterprise Enhanced self-hosted version for organizations requiring enterprise features including SAML SSO integration, audit logs, Kubernetes AutoScaling Runners, priority security notifications, SLA-backed support, and installation/upgrade assistance.
  • Gitea (Open Source) Free, open-source self-hosted Git platform under MIT license providing code hosting, issue tracking, pull requests, project management, integrated CI/CD via Gitea Actions, and a package registry with no user or repository limits.
  • Gitea Runner Self-hosted runner for Gitea Actions CI/CD that executes automated build, test, and deployment workflows with autoscaling support in Kubernetes environments for enterprise workloads.
  • Tea CLI Command-line interface tool for interacting with Gitea servers, enabling management of issues, pull requests, releases, and repository operations directly from the terminal.

Quantifiable outcome

  • 277M+ Docker pulls demonstrate widespread production deployment
  • +2 more outcomes

Companies that use Gitea

Customer profile

Named customers5 records

Segments4 records

Ideal customer profiles4 records

Gitea technology and API

Technology

Technology focussed Yes

API detail

Has API
Yes
API docs
API detail

Core technology

AI maturity

App detail

Integration14 records

Feature5 records

Gitea partnerships and signals

Strategic signal

Partnerships

Three partnerships are on record, tiered core.

  • GitHub ActionscoreTechnology or IntegrationGitea Actions is closely compatible with GitHub Actions, allowing users to reuse existing workflows and over 20,000 existing GitHub Actions plugins. This compatibility is a key differentiator enabling easy migration from GitHub.
  • KubernetescoreTechnology or IntegrationGitea supports Kubernetes deployment via official Helm charts and includes Kubernetes AutoScaling Runners for enterprise CI/CD workloads.
  • CommitGocoreStrategic or Co-development PartnerCommitGo, Inc. provides commercial leadership and support for Gitea. They manage enterprise offerings, cloud services, and product development direction while maintaining the open-source project's governance.

Scale indicators8 records

Recent moves6 records

Expansion highlights5 records

Gitea competitors and assessment

Company assessment

Emerging players

  • Sourcegraph: Sourcegraph is a code intelligence and search platform that integrates with multiple Git hosts including Gitea, GitHub, and GitLab. It is an adjacent peer serving enterprise developer productivity and code-search needs that complement Gitea's repository hosting layer.
  • Phabricator: Phabricator (and its fork Phorge) is an open-source software development platform with code review, repository hosting, and project management capabilities. It is an adjacent open-source, self-hosted DevOps alternative serving a similar developer audience.
  • RhodeCode: RhodeCode is a self-hosted source code management platform with Mercurial and Git support, code review, and enterprise security features. It is an emerging player targeting the same self-hosted enterprise DevOps segment that Gitea addresses with Gitea Enterprise.
  • OneDev: OneDev is an open-source, self-hosted DevOps platform offering Git hosting, CI/CD, Kanban, and package management. It is a niche emerging player competing for the same self-hosted DevOps workloads, often positioned against Gitea in self-hosted CI/CD comparisons.

Direct peers

  • GitLab: GitLab is the most direct competitor: an end-to-end DevOps platform offering self-hosted and SaaS Git hosting with CI/CD, issue tracking, package registry, and security scanning. Gitea competes most directly with GitLab's self-hosted Community Edition and premium tiers, often positioning itself as a lighter-weight alternative.
  • Forgejo: Forgejo is a soft-fork of Gitea created in late 2022 to provide a community-governed alternative after concerns about commercial direction under CommitGo. It is a direct functional peer with overlapping self-hosted Git, CI/CD, and package registry features and a similar target audience.

Broad incumbents

  • Bitbucket: Bitbucket (Atlassian) is an established Git hosting platform with both cloud and self-hosted (Data Center) deployment options, integrated with Jira. Competes with Gitea Enterprise for self-hosted enterprise Git and CI/CD workloads, particularly in Atlassian-centric shops.
  • GitHub: GitHub (Microsoft) is the dominant Git hosting and DevOps platform and the primary competitor Gitea targets for self-hosted migration. Gitea explicitly leverages GitHub Actions compatibility as a wedge to pull users off GitHub into self-hosted environments.
  • Azure DevOps (Repos): Microsoft Azure DevOps includes Git repositories, pipelines, package management, and boards as part of a broader DevOps suite. It is a broad incumbent that competes with Gitea for enterprise self-hosted and cloud DevOps workloads, particularly in Microsoft-centric IT environments.
  • AWS CodeCommit: AWS CodeCommit is Amazon's hosted Git service integrated with the broader AWS developer toolchain. It overlaps with Gitea Cloud as a managed Git hosting option and competes for cloud-first enterprises already on AWS infrastructure.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat5 records

Key risks6 records

Key highlights7 records

Customer concentration

Gitea social profiles

Digital presence

Gitea compliance and trust

Trust signal

Compliance1 record

Gitea financial estimates

Financial estimate

Revenue estimate

Valuation estimate

Gitea leadership team

Management profile

Number of profiles

Gitea funding detail

Funding detail

Funding overview

Funding rounds1 record

Investors1 record

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

Gitea M&A and investment

M&A and investment

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Gitea

What does Gitea do?

Gitea provides a self-hosted DevOps platform offering Git-based code hosting, integrated CI/CD through Gitea Actions (compatible with GitHub Actions), issue tracking, project management, and a package registry supporting 20+ formats. The platform is available as a free MIT-licensed open-source self-hosted product, a paid Gitea Enterprise self-hosted tier with SAML SSO and audit logs, and Gitea Cloud as a fully managed SaaS.

Is Gitea a public or private company?

Gitea is a private company. It is classified as venture growth investor backed and is currently operating.

When was Gitea founded?

Gitea was founded in 2016. It employs 1 to 10 people.

Where is Gitea based?

Gitea is headquartered in Not publicly disclosed, United States, in the North America region.

How does Gitea make money?

Two revenue lines are on record. Open Source (Free Tier) is the primary driver. The others are enterprise Subscription.

Who are Gitea's main competitors?

Emerging players on record are Sourcegraph, Phabricator, RhodeCode and OneDev. Direct peers are GitLab and Forgejo. Broad incumbents are Bitbucket, GitHub, Azure DevOps (Repos) and AWS CodeCommit.

Does Gitea have an API?

Yes. Gitea provides a REST API documented via Swagger/OAS 2.0. The API is MIT licensed. API documentation available at /api/swagger. Gitea also supports webhooks for extending functionality. Additionally, a Go SDK (gitea.com/gitea/go-sdk) and MCP (Model Context Protocol) integration (gitea-mcp) are available for programmatic access. Developer documentation is at gitea.com/api/swagger.

What industry is Gitea in?

Gitea's product category is DevOps Platform. Its primary akta.pro industry code is HDABAAAI, Developer Tools & DevOps Platform Services (CI/CD, Artifacts, IaC), with a secondary code of BPAEAKAN, GitOps & Continuous Delivery Operations. Its NAICS code is 513210 and its SIC code is 7372.

Unlock the full company data

50 free credits on sign-up, no credit card required.

Contact sales
Live signals
Cyber Security NewsGitea Patches 27 Security Flaws, Including Critical SSH Authentication Bypass and SSRFGitea released security updates for versions 28.0.0 and 28.1.0 addressing 27 flaws, including a critical SSH authentication bypass and SSRF weaknesses. The SSH bypass (CVE-2026-103059) has a CVSS score of 9.1 and affects deployments using Gitea's built-in SSH server. Administrators are urged to treat the update as urgent and review configuration changes.Cyber Security NewsCISA Warns of Gitea Code Injection Vulnerability Exploited in AttacksCISA added a newly disclosed Gitea code injection vulnerability, tracked as CVE-2026-60004, to its Known Exploited Vulnerabilities catalog, confirming active exploitation. The flaw lets attackers with repository write access send a malicious patch to the diffpatch API endpoint, planting a Git hook that runs arbitrary shell commands as the Gitea service account. CISA set a remediation deadline of August 28, 2026.Help Net SecurityCritical Gitea vulnerability now exploited in the wild (CVE-2026-60004)CISA added CVE-2026-60004, a critical code injection flaw in the Gitea Git platform, to its Known Exploited Vulnerabilities catalog, after a developer reported their self-hosted instance was compromised and used for crypto-mining. The flaw lets attackers run arbitrary shell commands as the Gitea OS user via the diffpatch endpoint, and CISA has ordered US federal civilian agencies to patch by August 28, 2026.SecurityWeekCISA Warns of Exploited Gitea VulnerabilityCISA warned organizations that a Gitea vulnerability allowing remote code execution is being exploited, adding CVE-2026-60004 to its Known Exploited Vulnerabilities catalog and setting an August 28 patch deadline. The flaw lets attackers with repository write access send a malicious patch to the diffpatch API endpoint to plant an executable Git hook. No prior exploitation reports exist, and the attacker's identity and goals remain unknown.WebProNewsCritical RCE Vulnerability (CVE-2026-41234) in Gitea 1.21–1.22.2 Allows Unauthenticated Remote Code ExecutionA critical remote code execution vulnerability (CVE-2026-41234) has been discovered in Gitea versions 1.21.0 through 1.22.2, rated the maximum 10/10 on the CVSS severity scale, allowing unauthenticated attackers to execute arbitrary commands via specially crafted repository migration requests. The flaw stems from improper sanitization of user-supplied data in the mirror_address field, which gets passed unsanitized to shell commands through Go's os/exec package. The vulnerability has been patched in version 1.22.3, and administrators are advised to upgrade immediately or restrict access to affected endpoints through reverse proxies or web application firewalls.The Hacker NewsCritical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode MarkupGitea disclosed and patched a critical file-read vulnerability (CVE-2026-59774, CVSS 9.8) in versions 1.22.1 through 1.27.0 that allowed unauthenticated attackers to read any file accessible to the service account by exploiting the Org-mode markup rendering endpoint on public repositories. The flaw, which stems from Gitea's Org-mode renderer not replacing the default ReadFile callback in the go-org library, has been fixed in version 1.27.1, though administrators are advised to rotate credentials if the markup endpoint was accessed on affected builds. Gitea noted the file-read primitive could potentially escalate to remote code execution if an attacker reads app.ini, extracts the INTERNAL_TOKEN, and injects a Git hook, though no active exploitation has been confirmed.Cyber Security NewsCritical Gitea Arbitrary File Read Vulnerability Enables Remote Code Execution AttacksA critical security vulnerability (CVE-2026-59774) in Gitea allows unauthenticated remote attackers to read arbitrary files from vulnerable servers and potentially achieve remote code execution, affecting versions 1.22.1 through 1.27.0. The flaw, rated Critical with a CVSS 9.8 score, exploits the repository markup-rendering feature through Org-mode's #+INCLUDE directive to access files readable by the Gitea service account, including configuration files, OAuth credentials, and database settings. Gitea administrators should immediately upgrade to version 1.27.1 and rotate exposed credentials, as the vulnerability could enable RCE via injected Git hooks.Cyber Security NewsCritical Gitea Vulnerability Allows Attackers to Execute Malicious Code RemotelyA critical remote code execution vulnerability (CVE-2026-60004) has been discovered in Gitea versions 1.17 through 1.27.0, residing in the diffpatch endpoint that processes repository patches using Git commands. The flaw has a CVSS v3.1 score of 9.8 (Critical) and allows attackers with standard repository write access to inject malicious Git hooks that execute arbitrary shell commands on the server, potentially exposing sensitive resources including configuration files, database credentials, and OAuth tokens. Gitea has released version 1.27.1 as a fix, and administrators are advised to upgrade promptly or restrict access to the vulnerable functionality until the patch is applied.The Hacker NewsNew Gitea RCE Lets Repository Writers Plant a Git Hook to Run Shell CommandsGitea has patched a critical remote code execution vulnerability (CVE-2026-60004, CVSS 9.8) that allowed users with repository write access to plant a Git hook and execute shell commands as the Gitea service account. The flaw, which affects versions 1.17 through 1.26.x, exploited the POST /api/v1/repos/{owner}/{repo}/diffpatch endpoint by submitting a malicious patch twice to create an add/add collision that bypassed the --cached flag. Gitea Cloud instances were automatically upgraded on July 27, 2026, and the fix is available in version 1.27.1, though the security fix was listed in release notes as a refactor rather than a security patch.Cyber Security NewsCritical Gitea Vulnerability Enables Private Repository Writes and Actions Workflow TriggersA critical vulnerability (CVE-2026-58443) has been disclosed in Gitea versions up to v1.26.4 that allows attackers with public-only repository access tokens to indirectly write to private pull request branches and trigger private Actions workflows, effectively bypassing token restrictions. The flaw, which exists in Gitea's pull request update API endpoint and has been fixed in v1.27.0, is rated Critical with a CVSS score of 9.6, enabling remote exploitation with low privileges and no user interaction. Gitea administrators are urged to upgrade immediately and audit their token permissions and pull request configurations to mitigate the authorization bypass.