Critical Gitea flaw lets anonymous users read server secrets from public repos

Gitea patched a critical flaw in the self-hosted Git platform that lets an unauthenticated attacker read any file the service account can access, needing only a public repository and crafted Org-mode markup. Tracked as CVE-2026-59774 and scored 9.8, it stems from the markup-rendering endpoint: Gitea initializes its Org-mode library without restricting file access, so the include directive accepts absolute paths and returns their contents. No login or write access is required. Gitea warns it can chain to command execution: read the configuration file, extract the internal token, inject a Git hook, and trigger it during an anonymous clone. It affects versions 1.22.1 through 1.27.0, fixed in 1.27.1.

Check

Upgrade self-hosted Gitea to 1.27.1 immediately, and if logs show requests to the markup endpoint on an affected build, treat all secrets readable by the Gitea service account as exposed.

Affected

Organizations running Gitea 1.22.1 through 1.27.0 with any public repository (CVE-2026-59774); an unauthenticated attacker can read configuration files, internal tokens, and signing keys, and potentially chain to code execution.

Fix

Update to 1.27.1, rotate the internal token and any credentials the service account can read, keep Gitea off the public internet where possible, and review logs for Org-mode markup requests.