Skip to content
Critical Gitea Vulnerability Exposes Server Files to Unauthenticated Attackers

Critical Gitea Vulnerability Exposes Server Files to Unauthenticated Attackers

First seen 5 Aug 2026, 14:08 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •August 6, 2026 at 14:08 UTC
  • •CVE-2026-59774 allows unauthenticated file access in Gitea versions 1.22.1 to 1.27.0.
  • •The vulnerability is patched in Gitea version 1.27.1, released on August 5, 2026.
  • •Organizations using affected versions are strongly advised to update immediately.

A critical vulnerability in Gitea, identified as CVE-2026-59774, allows unauthenticated attackers to read files accessible to the service account via crafted Org-mode markup. This flaw affects Gitea versions 1.22.1 through 1.27.0 and has been patched in version 1.27.1. The vulnerability poses a significant risk to organizations using affected versions, as it can lead to unauthorized access to sensitive server files. The issue was disclosed on August 5, 2026, and organizations are urged to update their Gitea installations immediately to mitigate risks. No evidence of active exploitation has been reported yet, but the potential for abuse remains high.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 46d ago How this analysis works

Timeline

2026-08-05
CVE-2026-59774 disclosed
A critical vulnerability in Gitea allows unauthenticated file access via Org-mode markup, affecting versions 1.22.1 to 1.27.0.
Feeds.4Sysops
2026-08-05
Patch released for Gitea
Gitea version 1.27.1 is released to address the critical vulnerability CVE-2026-59774.
Thehackernews

More articles in this cluster (5)

Following this threat?

Track CVE-2026-59774 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4