Threat Intelligence

Critical Gitea Vulnerability Lets Attackers Steal Server Files Without Logging In

The Hacker News · 5 Aug 2026

Key Takeaway If your business uses Gitea for source code management, update to version 1.27.1 or later immediately to close this critical security gap.

A serious security flaw has been found in Gitea, a popular self-hosted platform businesses use to manage source code and Git repositories. The vulnerability affects versions 1.22.1 through 1.27.0 and allows an attacker with no login credentials and no special access to read any file that the Gitea service account can reach on the server.

What makes this flaw particularly concerning is how little is required to exploit it. An attacker simply needs access to a public repository and the ability to craft specially formatted Org-mode markup content. There's no need for a valid account, password, or write permissions—making this an easy target for opportunistic attackers scanning the internet for vulnerable systems.

The issue, tracked as CVE-2026-59774, has been rated Critical with a CVSS score of 9.8 out of 10, reflecting the severity and ease of exploitation. Gitea has released a fix in version 1.27.1, and any business running an affected version should treat this as an urgent priority for patching, since exposed server files could include configuration data, credentials, or other sensitive information.

Gitea Critical Vulnerability Software Patch

Summarised by CISO AI from The Hacker News. We link back to every original so you can read it yourself.