{"vulnerability": "CVE-2026-59774", "sightings": [{"uuid": "5129d4ee-b12d-46fe-be13-65fec3d2341c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msajuqcla72s", "content": "Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution", "creation_timestamp": "2026-08-04T07:54:05.369348Z"}, {"uuid": "6d14d627-d059-4021-b022-ea5fb35c43b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "published-proof-of-concept", "source": "https://t.me/thehackernews/9713", "content": "- No login\n- No write access\n- Just crafted Org-mode markup\n\n\ud83d\uded1 CVE-2026-59774, a critical Gitea flaw, lets attackers use a public repository to read any file accessible to the Gitea service account. Gitea says it could also be chained into command execution.\n\nHow it works and what admins should check: https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "creation_timestamp": "2026-08-05T12:00:04.600578Z"}, {"uuid": "f8b7aae2-0abd-4725-99b9-ec658940b36e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3msdjlpgumd2c", "content": "\ud83e\udd16 CVE-2026-59774 (CVSS 9.8): unauthenticated file read in Gitea via crafted Org-mode markup. No login needed, a public repo is enough to read files accessible by the service account. Fixed in 1.27.1.\nhttps://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "creation_timestamp": "2026-08-05T12:27:01.486356Z"}, {"uuid": "ea20d4b9-a5d7-4a8a-b9aa-efcaa1e27da9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "content": "An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.\n\nThe file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its", "creation_timestamp": "2026-08-05T13:00:36.117690Z"}, {"uuid": "d641158a-1754-4ee3-a228-79d3415c5c54", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3msfzg6qjv72y", "content": "Gitea Vulnerability Enables Remote Code Execution (CVE-2026-59774) #patchmanagement", "creation_timestamp": "2026-08-06T12:15:34.905941Z"}, {"uuid": "2dbd93d0-d5af-4783-955b-da3d6d7f4a71", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-59774.yaml", "content": "", "creation_timestamp": "2026-08-13T09:00:10.412160Z"}, {"uuid": "82d47f86-9cd8-496e-9507-de433e61a005", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "published-proof-of-concept", "source": "Telegram/oryrocyfJIzbBSErsBZ4FQ1bOn27GRyNJiBDVHHRO9Y5Zzw", "content": "", "creation_timestamp": "2026-08-07T10:04:24.530314Z"}, {"uuid": "a91da1e1-e4e7-4b6a-a0a0-b1fac13ecc45", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://t.me/CyberDispatch/2480", "content": "CVE-2026-59774, a critical Gitea flaw, lets attackers use a public repository to read any file accessible to the Gitea service account. Gitea says it could also be chained into command execution.", "creation_timestamp": "2026-08-29T20:00:06.744692Z"}, {"uuid": "bdcd7133-dfa8-46f6-b422-bdb37b22ab03", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59774", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774.rb", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"xbow-security\", \"NightRang3r\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Forgejo versions 7.0 through 15.0.5 and 16.0.0 through 16.0.1 are\\n          vulnerable to an arbitrary file read via the markup rendering API\\n          endpoint. The go-org library's default ReadFile callback\\n          (ioutil.ReadFile) is not overridden, allowing the #+INCLUDE directive\\n          to read arbitrary files accessible to the service user.\\n\\n          Valid credentials are required to access the API markup endpoint.\\n          Extracting sensitive files such as app.ini can expose INTERNAL_TOKEN\\n          and other secrets, potentially leading to remote code execution.\", \"disclosure_date\": \"2026-07-30\", \"fullname\": \"auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774\", \"is_install_path\": true, \"mod_time\": \"2026-08-12 10:32:09 +0000\", \"name\": \"Forgejo Arbitrary File Read via Org-mode Include\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/forgejo_orgmode_fileread_cve_2026_59774\", \"references\": [\"CVE-2026-59774\", \"GHSA-6v53-hr58-556r\", \"URL-https://codeberg.org/forgejo/forgejo/pulls/13682\"], \"rport\": 3000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "creation_timestamp": "2026-08-24T06:44:13.952103Z"}]}