Critical Gitea Unauthenticated File Read Fixed in 1.27.1

Wed, 05 Aug 2026 13:01:27 +0000

Engineer — Act: Unauthenticated CVSS 9.8 file read affecting any Gitea 1.22.1–1.27.0 instance; a public repo and crafted Org-mode markup are the only prerequisites, exposing any file the service account can read (secrets, keys, configs). Patch to Gitea 1.27.1 immediately and audit service-account file permissions as a follow-up.
SOC/IR — Learn: No public PoC, no KEV listing, and no reported active exploitation means there is no immediate detection or hunt workload; awareness is useful context for triaging future anomalous Gitea traffic if exploitation begins.
Leader — Skip
Signals: CVE-2026-59774 — CISA KEV: not listed, EPSS n/a, no public PoC found

Self-Hosted-Git on CuraSec