Critical Gitea Flaw (CVE-2026-59774) Lets Attackers Read Server Files Without Login

A critical vulnerability in Gitea, the self-hosted Git platform, allows unauthenticated attackers to read any file the service account can access—no login or repository write access required. Tracked as CVE-2026-59774 and rated 9.8 on the CVSS scale, the bug affects Gitea versions 1.22.1 through 1.27.0 and was formally disclosed on August 2. The flaw lives in Gitea's Org-mode markup renderer, accessible via the POST /{owner}/{repo}/markup endpoint. When an anonymous request targets a public repository with its code unit enabled, Gitea resolves the route, passes the submitted Org-mode content to go-org, and—because Gitea 1.27.0 initialized the library with org.New() without overriding its default ioutil.ReadFile callback—honors the #+INCLUDE directive against absolute server paths. The attacker simply selects Mode: file and receives the file contents directly.

The vulnerability was discovered by XBOW Security, an autonomous offensive security system, and triaged by Guido Leo. Independent researcher Shai Rod, known online as NightRang3r, also reported the same issue. The fix shipped in Gitea 1.27.1 via PR #38642, backported in PR #38645, and now overrides the ReadFile callback so include paths render as plain content instead of resolving from the host filesystem. Gitea has also patched CVE-2026-60004, a separate remote code execution bug, in the same release. Cloud instances are being upgraded automatically; self-hosted administrators should move to 1.27.1 immediately and run a SSL/TLS checker to verify their instance is not exposing additional weak transport settings during the transition.

While the file-read path is not direct one-shot RCE, Gitea's own advisory outlines a chained escalation: read app.ini, extract INTERNAL_TOKEN, inject a Git hook through the internal logger, and trigger that hook during an anonymous clone. The Hacker News found no independently published exploit demonstrating the chain, but administrators should treat it as realistic. If logs show the markup endpoint was reached on an affected build, all credentials readable by the Gitea service account must be considered exposed. Rotate the internal token, OAuth secrets, JWT signing material, and database credentials before considering the instance clean, and validate the new material with a password checker to ensure strong replacement secrets.

Defenders should also review anonymous POST requests to /{owner}/{repo}/markup—particularly those selecting Org-mode rendering or submitting absolute include paths—and correlate them with subsequent file-system reads. Instances with no public repositories have no anonymous attack path through this endpoint, but private-only deployments are not immune if any repo is ever flipped to public. For organizations running multiple self-hosted services, a quick port scanner sweep will confirm Gitea is not exposed on unintended interfaces while the patch is being rolled out.