CVE-2026-59774: Gitea Org-mode file disclosure and code execution
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNALTOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Gitea instances with a suitable public repository are exposed to unauthenticated file disclosure through the repository markup endpoint. Files readable by the Gitea service account may be accessible.
What does an attacker need to achieve code execution?
The attacker must first disclose app.ini and obtain its INTERNAL_TOKEN. They can then use internal logger access to modify a Git hook and execute commands as the Gitea service account.
Is authentication required to exploit the file disclosure?
No. The disclosure can be performed by an unauthenticated attacker when a suitable public repository is available.
What level of access could an attacker gain through code execution?
Commands execute as the Gitea service account. The issue does not state that root or host-administrator access is obtained directly.