CVE-2026-59774Critical· 9.8▾ AbyssalPoC availableGitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files acces…
▾ Abyssal zone — Critical with a public exploit or in-the-wild use
impact 53.9 · likelihood 5.7 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 3 sources. Availability, not in-the-wild use.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 9.8
none → critical
Last analysed / modified upstream
28%
3 GitHub repos · Metasploit ×1 · Nuclei ×1 (last check)
Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-60004Critical· 9.8Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
CVE-2026-97859Medium· 6.5Gitea API disclosure of private user social graph, keys and stars
CVE-2026-73804High· 8.1Gitea allows a token with write:user scope to register an attacker-controlled SSH public key on the token owner's account
CVE-2026-97204Low· 3.1Gitea label deletion across repository and organization IDs
CVE-2026-107618NoneGitea cross-site request forgery on repository topics
CVE-2026-109553High· 7.5Gitea SSH certificate principal impersonation of other users