CVE-2026-59774 and the exposure
CVE-2026-59774, rated Critical with a CVSS score of 9.8, allowed an unauthenticated attacker to read "any file the service account can access" on self-hosted Gitea instances running versions 1.22.1 through 1.27.0, according to the advisory and reporting by The Hacker News. The vulnerability was formally published on August 2 and fixed in Gitea 1.27.1.
The immediate practical consequence was stark: "No login, no repository write access. A public repository and crafted Org-mode markup are enough." Gitea said Cloud instances would be upgraded automatically during the release maintenance window, and it advised that self-hosted administrators "should move to 1.27.1 immediately."
No badge required: anonymous markup endpoint and Org-mode include
The file-read path ran through Gitea's markup rendering endpoint, POST /{{owner}}/{{repo}}/markup. That route "allows optional sign-in, resolves the repository, and checks reader access." But an anonymous request clears the reader-access check for any public repository with its code unit enabled, creating the unauthenticated attack path.
The underlying cause was in Gitea's Org-mode renderer. Gitea 1.27.0 initialized the go-org library with org.New() and did not replace the library's default ReadFile callback. In go-org 1.9.1 that callback is ioutil.ReadFile, and Org-mode's #+INCLUDE directive accepts absolute filesystem paths and passes them to that callback. An attacker could submit Org-mode markup, select Mode: file, and receive files readable by the Gitea service account.
Your scanner finds 4,000 vulns. Which 12 matter?
Nubivance is a Rapid7 Registered Partner delivering vulnerability management as a service - scanning, risk-based prioritization, and remediation follow-through across IT and OT.
Fix the backlog →Patch details and engineering response
Gitea fixed the problem in PR #38642 and backported the change in PR #38645. The patch overrides ReadFile so that an Org-mode include path is returned as plain rendered content instead of being resolved from the server filesystem. The change also added a regression test for include-path rendering.
Gitea 1.27.1 also addressed a separate issue, CVE-2026-60004, a remote code execution bug covered in a prior The Hacker News report. The combined release was the vehicle for correcting both flaws.
Patch, detection, and remediation steps for administrators
- Upgrade: Move affected instances to Gitea 1.27.1. Gitea indicated Cloud instances would receive the upgrade automatically during the maintenance window; self-hosted installations must upgrade themselves.
- Log review: "Review anonymous POST requests to /{{owner}}/{{repo}}/markup, especially requests selecting Org-mode rendering or submitting absolute filesystem paths," the advisory recommends.
- Assume credential exposure after suspected access: If logs show the markup endpoint was reached on an affected build, treat credentials readable by the Gitea service account as exposed. Rotate the INTERNAL_TOKEN, OAuth material, JWT signing material, and database credentials before considering the instance clean.
- Check hooks: If the advisory's escalation path was attempted, check repository hook directories for unexpected executable files.
How the file-read primitive could escalate to command execution
Gitea cautioned the file-read bug was "not [a] direct one-request remote code execution." However, it documented a chain: read app.ini, extract INTERNAL_TOKEN, inject a Git hook through the internal logger, and trigger that hook during an anonymous clone. That escalation path is described in Gitea's advisory; The Hacker News found "no independently published exploit demonstrating it," and the token-to-hook command-execution chain currently remains single-sourced to Gitea's advisory.
The advisory therefore treats upgrade as necessary but possibly insufficient after suspected exposure: administrators who see evidence of access must rotate internal tokens and other signing or credential material rather than rely solely on patching.
What this means for self-hosted administrators, cloud customers, and attackers
- Self-hosted administrators: Urgently upgrade to 1.27.1 and review POST /{{owner}}/{{repo}}/markup logs for anonymous Org-mode requests or absolute paths; if the endpoint was reached, rotate INTERNAL_TOKEN, OAuth keys, JWT signing material, and database credentials.
- Cloud customers: Expect automatic upgrades during the vendor maintenance window; nevertheless, verify whether the provider applied 1.27.1 and review any relevant logs if public repositories are enabled.
- Attackers and red teams: The file-read primitive was publicly previewed before the formal advisory, per The Hacker News, but as of August 5, 2026 The Hacker News reported no independently published exploit and Gitea's escalation chain remains documented only in the vendor advisory.
Contextually, the advisory came amid a busy stretch of Gitea security work: in June Gitea patched a critical reverse-proxy authentication bypass in Docker images (CVE-2026-20896) that was probed 13 days after disclosure, and in May a container-registry access-control flaw (CVE-2026-27771) was estimated to affect more than 30,000 deployments across over 30 countries.
The vulnerability was discovered by XBOW Security, an autonomous offensive security system, and triaged by Guido Leo; Shai Rod, known online as NightRang3r, independently reported the same issue. Gitea reported no exploitation in the wild, and as of August 5, 2026 CVE-2026-59774 had not appeared on CISA's Known Exploited Vulnerabilities catalog.
Patching is the immediate, necessary step — but for administrators who detect use of the vulnerable markup endpoint, the advisory's clear instruction is to assume credential exposure and rotate internal tokens and signing materials before declaring the system clean.
