Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Gitea Org-mode file-read flaw (CVE-2026-59774)

Vulnerability
First reported
Last updated
Happening score
H score 60
1 unique sources, 1 articles

Summary

Hide ▲

A Critical CVE-2026-59774 flaw in Gitea lets an unauthenticated attacker read files the service account can access on versions 1.22.1 through 1.27.0, and 1.27.1 fixes it. The path runs through crafted Org-mode markup in a public repository and can expose sensitive files such as app.ini. No exploitation in the wild has been reported, but the read primitive can support a command-execution chain if token material is exposed.

Related Happenings

Gitea diffpatch endpoint RCE (CVE-2026-60004)

Vulnerability
H score41 First: 29.07.2026 10:47 Last: 29.07.2026 10:47 Sources 1

About this happening: CVE-2026-60004 is a critical remote code execution flaw in Gitea that lets a user with repository write access run shell commands as the Gitea service account. The...

Open Happening

CISA BOD 22-01 federal remediation directive

Public Sector Action
H score89 First: 23.01.2026 20:47 Last: 23.01.2026 20:47 Sources 1

About this happening: CISA required federal agencies covered by BOD 22-01 to apply available security updates or vendor-suggested mitigations, or stop using the affected products by Febru...

Open Happening

Timeline

  1. 05.08.2026 14:04 1 articles · 1h ago

    Gitea discloses critical Org-mode file-read flaw

    Initial Disclosure

    Gitea's formal advisory describes CVE-2026-59774 as a Critical file-read flaw in the self-hosted Git platform, affecting versions 1.22.1 through 1.27.0 and fixed in Gitea 1.27.1. The issue lets an unauthenticated attacker read any file the service account can access through crafted Org-mode markup in a public repository.

    Show sources
    Open in new tab
  2. 05.08.2026 14:04 2 articles · 1h ago

    Gitea details Org-mode renderer chain and upgrade guidance for CVE-2026-59774

    Technical Analysis Update

    Gitea says the file-read path runs through POST /{owner}/{repo}/markup in its Org-mode renderer; Gitea 1.27.0 initialized go-org with org.New() and left the default ReadFile callback in place, so #+INCLUDE paths could resolve from the server filesystem and expose files readable by the service account. Gitea also says the read primitive can lead to command execution if app.ini reveals INTERNAL_TOKEN and a Git hook is injected, and it advises upgrading to Gitea 1.27.1 and rotating internal token, OAuth material, JWT signing material, and database credentials after suspected exposure.

    Show sources
    Open in new tab