An unauthenticated attacker could read any file accessible to the service account on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0, according to an advisory published by The Hacker News on August 5, 2026. No login credentials or repository write permissions were required—only a public repository and specially crafted Org-mode markup. The vulnerability has been patched in Gitea 1.27.1, released with a formal advisory on August 2.
The file-read vulnerability, designated CVE-2026-59774, carries a Critical severity rating with a CVSS score of 9.8. The flaw exploits Gitea's markup rendering endpoint, POST /{owner}/{repo}/markup, which permits optional authentication and grants access to any public repository with its code unit enabled. The break occurs in Gitea's Org-mode renderer: version 1.27.0 initialized go-org with org.New() but failed to override the library's default ReadFile callback, which in go-org 1.9.1 is ioutil.ReadFile. Org-mode's #+INCLUDE directive accepts absolute paths and passes them directly to this callback, allowing an attacker to submit Org-mode markup, select Mode: file, and retrieve files the service account can read. The patched version overrides ReadFile so include paths are rendered as plain content rather than resolved from the server filesystem. Gitea 1.27.1 also addresses CVE-2026-60004, a separate remote code execution bug covered in a prior report.
The report states that the file-read bug is not direct one-request remote code execution, but it can escalate to command execution if an attacker reads app.ini, extracts INTERNAL_TOKEN, injects a Git hook through the internal logger, and triggers that hook during an anonymous clone. Gitea said Cloud instances would be upgraded automatically during the release maintenance window, while self-hosted administrators should move to version 1.27.1 immediately. CVE-2026-59774 was discovered by XBOW Security, an autonomous offensive security system, and triaged by Guido Leo; Shai Rod, known online as NightRang3r, independently reported the same issue. According to the advisory, no exploitation in the wild has been observed, and as of August 5, 2026, CVE-2026-59774 had not appeared on CISA's Known Exploited Vulnerabilities catalog.
The exposure carries heightened risk because an instance with no public repositories has no anonymous attack path through this endpoint, but any public repository opens the door. Upgrading to 1.27.1 is necessary but may not be sufficient after suspected exposure. If logs show the markup endpoint was accessed on an affected build, administrators should treat credentials readable by the Gitea service account as compromised and rotate the internal token, OAuth material, JWT signing material, and database credentials before considering the instance secure. Administrators should review anonymous POST requests to /{owner}/{repo}/markup, especially those selecting Org-mode rendering or submitting absolute filesystem paths, and check repository hook directories for unexpected executable files. The file-read primitive was publicly previewed before its formal advisory, according to a prior report, though the token-to-hook command-execution chain remains single-sourced to Gitea's advisory.
The flaw follows a dense period of Gitea security work. In June, Gitea patched a critical reverse-proxy authentication bypass in Docker images, CVE-2026-20896, that threat actors were observed probing 13 days after disclosure. In May, a container-registry access-control flaw, CVE-2026-27771, was estimated to affect more than 30,000 deployments across over 30 countries. The fix for CVE-2026-59774 landed in PR #38642 and was backported in PR #38645, with a regression test added for include-path rendering. For self-hosted Gitea users, rapid patching and post-exposure credential rotation are now the baseline response. Continuous security scrutiny of self-hosted development platforms may force teams to reconsider whether the operational flexibility justifies the expanded attack surface and response burden.