CVE-2026-59774

Gitea's Org-mode markup renderer follows INCLUDE directives sent to the repository markup endpoint without blocking access to files on the server. An unauthenticated attacker who can use a suitable public repository can read files the Gitea service account can open. If those files include app.ini and its INTERNAL_TOKEN, the disclosure can be chained with internal logger access to change a Git hook and run commands as the Gitea service account, so the impact is confidential file disclosure with a path to remote command execution. Self-hosted Gitea deployments that render Org-mode markup for repositories reachable by unauthenticated users are affected; the advisory data does not name fixed or vulnerable version ranges. It is not listed in CISA KEV, and no public proof-of-concept is known.

What to do: Apply the vendor fix for CVE-2026-59774 as soon as it is available for your Gitea release, and until then limit unauthenticated access to repository markup rendering (especially Org-mode). If a public repository may already have been used this way, treat app.ini as exposed: rotate INTERNAL_TOKEN and other secrets in that file, and review Git hooks and the service account for unauthorized changes.