Access Vulnerability in Gitea's Org-mode Markup Renderer
CVE-2026-59774

Currently unrated

Key Information:

Vendor

Gitea

Status
Gitea
Vendor
CVE Published:
14 October 2026

Badges

📰 News Worthy

What is CVE-2026-59774?

Gitea's Org-mode markup renderer has a vulnerability where INCLUDE directives are processed without proper file access restrictions. This oversight allows unauthenticated attackers to exploit public repositories to gain access to sensitive files that are otherwise protected. If an attacker retrieves files such as app.ini, containing the INTERNAL_TOKEN, they could potentially leverage this information along with internal logger access to modify Git hooks, leading to command execution under the context of the Gitea service account.

Affected Version(s)

Gitea 1.22 < 1.27.1

News Articles

favicon imageThe Hacker News

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup

Gitea fixes CVE-2026-59774, a 9.8 flaw letting unauthenticated attackers read service-account files through crafted Org-mode markup on public reposito

References

https://github.com/go-gitea/gitea/security/advisories/GHS...
vendor-advisory
https://github.com/go-gitea/gitea/pull/38642
patch
https://blog.gitea.com/release-of-1.27.1/
release-notes

Timeline

  • Vulnerability published

  • 📰

    First article discovered by The Hacker News

  • Vulnerability Reserved

Credit

https://github.com/fedek-xbow
https://github.com/xbow-security
https://github.com/gleo-xbow
https://github.com/NightRang3r
.