importantSYS.SOURCE: The Hacker News• 2026-08-05T16:34:23+05:30

Critical Gitea Vulnerability Allows Unauthenticated File Access via Org-Mode Markup

#vulnerability #gitea #security #file-access #devops

A critical vulnerability (CVE-2026-59774) in Gitea versions 1.22.1-1.27.0 allows unauthenticated attackers to read server files via Org-mode markup rendering. The flaw was fixed in version 1.27.1, but administrators must rotate credentials if exposure is suspected.

An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.

The file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its

Read original article

*** END OF TRANSMISSION ***

> COMPARATIVE ANALYSIS OF ZIG AND RUST: DEVELOPER EXPERIENCE AND STRUCTURAL APPROACHES > INTRODUCING TIN: A HIGH-PERFORMANCE FULL-TEXT SEARCH EXTENSION FOR POSTGRESQL > VALS AIMS TO REVOLUTIONIZE AI BENCHMARKING WITH INDUSTRY-SPECIFIC EVALUATIONS > LAYA: OPEN-SOURCE SYSTEM 1 DECISION ENGINE WITH MULTILINGUAL SUPPORT > RESEARCHERS EXPLOIT CHAINED VULNERABILITIES IN OPENAI VIA CLAUDE OPUS 5 AI ASSISTANCE > SOLARWINDS ADDRESSES CRITICAL ARM VULNERABILITY (CVE-2026-28326) WITH UNAUTHENTICATED RCE RISK > LEVERAGING AI FOR DIVERSE POSTER DESIGN: BEYOND THE DEFAULT TEMPLATES > CRITICAL PRE-AUTH RCE VULNERABILITY IN ORKES CONDUCTOR WORKFLOW PLATFORM EXPLOITED IN THE WILD > GOOGLE GEMINI AI SYSTEM UNAUTHORIZED ACCESS INCIDENT DUE TO DOMAIN NAMING ERROR > CROWDSEC DISCLOSES DATA BREACH VIA TANSTACK NPM SUPPLY CHAIN ATTACK INVOLVING 170 PRIVATE GITHUB REPOSITORIES> COMPARATIVE ANALYSIS OF ZIG AND RUST: DEVELOPER EXPERIENCE AND STRUCTURAL APPROACHES > INTRODUCING TIN: A HIGH-PERFORMANCE FULL-TEXT SEARCH EXTENSION FOR POSTGRESQL > VALS AIMS TO REVOLUTIONIZE AI BENCHMARKING WITH INDUSTRY-SPECIFIC EVALUATIONS > LAYA: OPEN-SOURCE SYSTEM 1 DECISION ENGINE WITH MULTILINGUAL SUPPORT > RESEARCHERS EXPLOIT CHAINED VULNERABILITIES IN OPENAI VIA CLAUDE OPUS 5 AI ASSISTANCE > SOLARWINDS ADDRESSES CRITICAL ARM VULNERABILITY (CVE-2026-28326) WITH UNAUTHENTICATED RCE RISK > LEVERAGING AI FOR DIVERSE POSTER DESIGN: BEYOND THE DEFAULT TEMPLATES > CRITICAL PRE-AUTH RCE VULNERABILITY IN ORKES CONDUCTOR WORKFLOW PLATFORM EXPLOITED IN THE WILD > GOOGLE GEMINI AI SYSTEM UNAUTHORIZED ACCESS INCIDENT DUE TO DOMAIN NAMING ERROR > CROWDSEC DISCLOSES DATA BREACH VIA TANSTACK NPM SUPPLY CHAIN ATTACK INVOLVING 170 PRIVATE GITHUB REPOSITORIES