Critical Gitea CVE-2026-59774 (CVSS 9.8) Enables Unauthenticated File Read

Vulnerability Overview

CVE‑2026‑59774 is a critical security flaw in the self‑hosted Git platform Gitea, assigned a CVSS score of 9.8. The bug allows an attacker who does not log in to read any file that the Gitea service account can access by submitting a specially crafted Org‑mode markup payload to the public repository markup endpoint.

Affected and Fixed Versions

The issue impacts Gitea versions 1.22.1 through 1.27.0 . It was patched in version 1.27.1 , which also resolves a separate remote‑code‑execution vulnerability (CVE‑2026‑60004).

Attack Preconditions

The target instance must host at least one public repository with code unit enabled.

The attacker can send an anonymous POST request to the /{owner}/{repo}/markup endpoint.

Because the anonymous request only passes the public‑repository read‑access check, any Gitea instance exposing a public repo is vulnerable.

Root Cause: Unsafe Org‑mode Renderer Configuration

In Gitea 1.27.0 the go‑org library is initialized with org.New() without replacing the default ReadFile callback. The default callback in go‑org 1.9.1 forwards to ioutil.ReadFile, which accepts arbitrary absolute paths. The Org‑mode # +INCLUDE directive triggers this callback, allowing arbitrary file inclusion.

By submitting markup that selects the Mode: file rendering mode, an attacker can cause the server to read any file the service account can access.

From File Read to Remote Code Execution: Full Attack Chain

Read the app.ini configuration file, which contains sensitive settings.

Extract the INTERNAL_TOKEN from app.ini; this token authenticates internal API calls.

Use the stolen token to inject a malicious Git hook via the internal log API.

Trigger the malicious hook by performing an anonymous clone operation, achieving remote code execution.

The chain is described in Gitea’s official advisory; as of 5 August 2026, no public exploit code has been released.

Discovery and Context

The flaw was independently discovered by XBOW Security’s automated testing platform and by independent researcher NightRang3r. It follows a series of recent Gitea security updates, including CVE‑2026‑20896 (reverse‑proxy auth bypass) and CVE‑2026‑27771 (container registry ACL issue), highlighting the growing attack surface of self‑hosted development platforms.

Blue‑Team Detection and Response

According to the MITRE ATT&CK framework, the vulnerability maps to the following tactics:

Initial Access (TA0001) : Exploit the flaw to reach the system.

Discovery (TA0007) : Read configuration files to gather sensitive data.

Credential Access (TA0006) : Steal the INTERNAL_TOKEN.

Execution (TA0002) : Trigger command execution via a Git hook.

Response Checklist

Urgent : Upgrade to Gitea 1.27.1 to patch the vulnerability and CVE‑2026‑60004.

High : Verify whether the vulnerability has been exploited by inspecting the markup endpoint for suspicious requests.

High : Rotate the INTERNAL_TOKEN immediately if exposure is suspected.

High : Rotate OAuth and JWT keys to prevent credential reuse.

Medium : Review database credentials stored alongside app.ini and rotate if necessary.

Medium : Audit the Git‑hook directory for unexpected executable files.

Low : Enable audit logging to improve detection of anomalous behavior.

Detection Recommendations

Monitor anonymous POST requests to /{owner}/{repo}/markup, especially those using Org‑mode rendering or containing absolute file paths.

Alert on payloads that reference sensitive paths such as /etc/passwd, /proc/self/, or app.ini.

Analyze internal API call patterns for unusual IP sources or frequencies.

Track creation or modification events in the Git‑hook directory.

Mitigation Measures (If Immediate Upgrade Is Not Possible)

Block anonymous access to the /{owner}/{repo}/markup endpoint at the reverse‑proxy layer.

Temporarily disable Org‑mode rendering or convert all public repositories to private.

Restrict service‑account permissions to the minimal required directory set.

Conclusion

CVE‑2026‑59774 exemplifies how a seemingly harmless feature—Org‑mode document rendering—can become a high‑impact attack vector when underlying library callbacks are misconfigured. The vulnerability is trivial to exploit (no authentication or privileges required) yet allows arbitrary file read and potential remote code execution. Organizations running self‑hosted Gitea should upgrade to 1.27.1 immediately, audit pre‑upgrade logs, and rotate any exposed credentials.