Critical Gitea Vulnerability Exposes Server Files to Unauthenticated Attackers

A critical vulnerability in Gitea, identified as CVE-2026-59774, allows unauthenticated attackers to read files accessible to the service account via crafted Org-mode markup. This flaw affects Gitea versions 1.22.1 through 1.27.0 and has been patched in version 1.27.1. The vulnerability poses a significant risk to organizations using affected versions, as it can lead to unauthorized access to sensitive server files. The issue was disclosed on August 5, 2026, and organizations are urged to update their Gitea installations immediately to mitigate risks. No evidence of active exploitation has been reported yet, but the potential for abuse remains high.

Key Points: • CVE-2026-59774 allows unauthenticated file access in Gitea versions 1.22.1 to 1.27.0. • The vulnerability is patched in Gitea version 1.27.1, released on August 5, 2026. • Organizations using affected versions are strongly advised to update immediately.