Access Vulnerability in Gitea's Org-mode Markup Renderer
CVE-2026-59774

9.8CRITICAL

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

Badges

🟣 EPSS 28%📰 News Worthy

What is CVE-2026-59774?

Gitea's Org-mode markup renderer has a vulnerability where INCLUDE directives are processed without proper file access restrictions. This oversight allows unauthenticated attackers to exploit public repositories to gain access to sensitive files that are otherwise protected. If an attacker retrieves files such as app.ini, containing the INTERNAL_TOKEN, they could potentially leverage this information along with internal logger access to modify Git hooks, leading to command execution under the context of the Gitea service account.

Affected Version(s)

Gitea 1.22 < 1.27.1

News Articles

favicon imageThe Hacker News

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

Gitea fixes CVE-2026-59774, a 9.8 flaw letting unauthenticated attackers read service-account files through crafted Org-mode markup on public reposito

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/38642
patch
https://blog.gitea.com/release-of-1.27.1/
release-notes

EPSS Score

28% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • 📰

    First article discovered by The Hacker News

  • Vulnerability Reserved

Credit

https://github.com/fedek-xbow
https://github.com/xbow-security
https://github.com/gleo-xbow
https://github.com/NightRang3r
.