Gitea Critical Flaw Allows Unauthenticated Server File Reading

A critical security vulnerability, tracked as CVE-2026-59774, has been identified in the self-hosted Git platform Gitea, affecting versions 1.22.1 through 1.27.0. This flaw permits unauthenticated attackers to read any file accessible by the Gitea service account on the server. The exploit does not require any form of user login or write access to a repository. Instead, an attacker can leverage a public repository and specially crafted Org-mode markup to trigger the vulnerability. The severity of this issue has been rated as Critical, with a CVSS score of 9.8, indicating a high potential for exploitation and significant impact. The vulnerability was publicly disclosed and subsequently patched by the Gitea team in version 1.27.1, which was released to address this specific security concern. Users of Gitea are strongly advised to update to version 1.27.1 or later to mitigate the risk of exploitation. The nature of the exploit, involving Org-mode markup, suggests a sophisticated method of data exfiltration that bypasses standard access controls. Org-mode is a major mode for the Emacs text editor used for note-taking and project management, and its markup language can be parsed by Gitea. The vulnerability arises from how Gitea processes certain Org-mode elements, potentially leading to unintended file path traversal or disclosure. This incident highlights the ongoing challenges in securing software supply chains and the importance of rigorous security auditing for open-source projects that handle sensitive code and data. Gitea, developed in Go, is a popular choice for developers and organizations seeking a self-hosted alternative to platforms like GitHub or GitLab. Its open-source nature fosters community contributions but also necessitates vigilant security practices from both developers and users. The high CVSS score underscores the immediate threat posed by this vulnerability, as it allows for unauthorized access to potentially sensitive server files without requiring any prior authentication, making it an attractive target for malicious actors. The fix in Gitea 1.27.1 involves input validation and sanitization to prevent the malicious parsing of Org-mode markup that could lead to file disclosure. The Gitea security advisory also provides detailed information for users on how to check their current version and the steps required for updating. The disclosure of CVE-2026-59774 serves as a reminder for all software providers to prioritize security and to respond swiftly to reported vulnerabilities, especially those with critical severity ratings. The rapid release of a patch demonstrates the Gitea team's commitment to user security.