Gitea 1.27.1 closes unauthenticated server file-read flaw

Gitea has fixed CVE-2026-59774, a Critical vulnerability that allowed unauthenticated attackers to read any file accessible to the service account. The flaw affected versions 1.22.1 through 1.27.0 and is resolved in Gitea 1.27.1.

The vulnerability carries a CVSS score of 9.8. An attacker required no account or repository write access: a public repository with its code unit enabled and crafted Org-mode markup were sufficient. Gitea Cloud instances were due to receive the update automatically during the release maintenance window, while self-hosted administrators were advised to upgrade immediately.

How Org-mode exposed local files

The vulnerable path ran through POST /{owner}/{repo}/markup. This rendering route permits optional sign-in, resolves the repository and checks reader access. For a public repository, an anonymous request could pass that check. Instances without public repositories therefore had no anonymous attack path through this endpoint.

Gitea 1.27.0 initialized go-org with org.New() but did not replace the library's default ReadFile callback. In go-org 1.9.1, that callback is ioutil.ReadFile. Org-mode's #+INCLUDE directive accepts absolute paths and supplied them to the callback, allowing submitted markup in file mode to return readable server files.

The fix arrived in PR #38642 and was backported in PR #38645. Gitea now overrides ReadFile, causing an include path to appear as plain rendered content rather than being resolved against the server filesystem. A regression test was added for include-path rendering.

Possible escalation and exposure response

The flaw is not direct, single-request remote code execution. Gitea's advisory describes a potential chain in which an attacker reads app.ini, extracts INTERNAL_TOKEN, injects a Git hook through the internal logger and triggers it during an anonymous clone. The Hacker News found no independently published exploit demonstrating that chain.

This incident also reflects borrowed trust as a recurring cybersecurity tactic because a public repository supplied the trusted context needed to reach the vulnerable renderer without signing in. CVE-2026-59774 was found by XBOW Security and independently reported by Shai Rod.

Gitea published no formal detection guidance. Administrators should review anonymous POST requests to the markup route, particularly those selecting Org-mode rendering or providing absolute filesystem paths. If the escalation path may have been attempted, repository hook directories should also be checked for unexpected executable files.

Gitea reported no exploitation in the wild, and the vulnerability was absent from CISA's Known Exploited Vulnerabilities catalog as of August 5, 2026. However, the file-read primitive had been publicly previewed before the formal advisory issued on August 2.

What businesses should do now

Upgrading to Gitea 1.27.1 is the immediate priority, but a patch alone may not resolve suspected exposure. If logs indicate that the markup endpoint was reached on an affected build, organizations should treat credentials readable by the service account as compromised and rotate the internal token, OAuth material, JWT signing material and database credentials before declaring the instance clean.