Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org

Back Thehackernews

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org

Thehackernews •[email protected] (The Hacker News) • August 5, 2026

Share: View original

Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt, and governance at scale.

Learn how to govern risk, secure AI-built software, and keep control as development moves at machine speed.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical Gitea Vulnerability Exposes Server Files to Unauthenticated Attackers A critical vulnerability in Gitea, identified as CVE-2026-59774, allows unauthenticated attackers to read files accessible to the service account via crafted Org-mode markup. This flaw affects Gitea versions 1.22.1 through 1.27.0 and has been patched in version 1.27.1. The vulnerability poses a significant risk to organizations using affected versions, as it can lead to unauthorized access to sensitive server files. The issue was disclosed on August 5, 2026, and organizations are urged to update their Gitea installations immediately to mitigate risks. No evidence of active exploitation has been reported yet, but the potential for abuse remains high. 3 sources 72

Extracted Entities

Attack Types (1)

CWE Weaknesses (2)

CWE-287 - Improper Authentication CWE-862 - Missing Authorization

Platforms (1)