Act
active
Critical Gitea Unauthenticated File Read Fixed in 1.27.1
- Engineer — Act: Unauthenticated CVSS 9.8 file read affecting any Gitea 1.22.1–1.27.0 instance; a public repo and crafted Org-mode markup are the only prerequisites, exposing any file the service account can read (secrets, keys, configs). Patch to Gitea 1.27.1 immediately and audit service-account file permissions as a follow-up.
- SOC/IR — Learn: No public PoC, no KEV listing, and no reported active exploitation means there is no immediate detection or hunt workload; awareness is useful context for triaging future anomalous Gitea traffic if exploitation begins.
- Leader — Skip
- Signals: CVE-2026-59774 — CISA KEV: not listed, EPSS n/a, no public PoC found
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.