How severe is CVE-2026-59774?

CVE-2026-59774 has a CVSS 3.1 base score of 9.8 (CRITICAL). EPSS estimates a 28.3% probability of exploitation in the next 30 days.

CVE-2026-59774: Gitea Org-mode file disclosure and code execution

Description

Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.

Severity

CVSS 3.1 · CISA9.8 CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC · CISA-ADP

Exploitationnone

Automatableyes

Technical impacttotal

Exploitation Context

as of October 16, 2026

All KEV statistics→

Its current EPSS score (28.3%) is higher than that of 40% of CISA KEV entries.

Affected Products

Vendor	Product	Affected versions
Gitea	Gitea Gitea	1.22 to <1.27.1

References

6 Links

Vendor advisories

GitHub Security Advisory GHSA-6v53-hr58-556r

Patches

Release notes

Other references

http://www.openwall.com/lists/oss-security/2026/08/10/3

Record Details

Published

2026-10-14

Last updated

2026-10-15

Assigner (CNA)

Gitea

Credited to

https://github.com/fedek-xbow; https://github.com/xbow-security; https://github.com/gleo-xbow; https://github.com/NightRang3r

More from Gitea

CVE-2026-600049.8 CRITICAL

Gitea Code Injection Vulnerability

GiteaKEVEPSS 24.0%2026-08-26

Tool categories

Application Security Tools Penetration Testing Tools

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.

CVE-2026-59774