{"metadata": {"vulnerability": "CVE-2026-59774", "count": 29, "kinds": {"milestone": 3, "sighting": 14, "kev": 5, "other": 7}}, "data": [{"timestamp": "2026-07-08T09:19:07.145Z", "date_only": false, "value": "2026-07-08T09:19:07.145Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-59774", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-08-04T07:54:05.369Z", "date_only": false, "value": "2026-08-04T07:54:05.369348Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3msajuqcla72s", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "5129d4ee-b12d-46fe-be13-65fec3d2341c", "content": "Gitea Vulnerability CVE-2026-59774 Enables Unauthenticated Remote Code Execution", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3msajuqcla72s"}, {"timestamp": "2026-08-05T12:00:04.600Z", "date_only": false, "value": "2026-08-05T12:00:04.600578Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/thehackernews/9713", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "6d14d627-d059-4021-b022-ea5fb35c43b3", "content": "- No login\n- No write access\n- Just crafted Org-mode markup\n\n\ud83d\uded1 CVE-2026-59774, a critical Gitea flaw, lets attackers use a public repository to read any file accessible to the Gitea service account. Gitea says it could also be chained into command execution.\n\nHow it works and what admins should check: https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "url": "https://t.me/thehackernews/9713"}, {"timestamp": "2026-08-05T12:27:01.486Z", "date_only": false, "value": "2026-08-05T12:27:01.486356Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/newssecia.bsky.social/post/3msdjlpgumd2c", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "f8b7aae2-0abd-4725-99b9-ec658940b36e", "content": "\ud83e\udd16 CVE-2026-59774 (CVSS 9.8): unauthenticated file read in Gitea via crafted Org-mode markup. No login needed, a public repo is enough to read files accessible by the service account. Fixed in 1.27.1.\nhttps://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "url": "https://bsky.app/profile/newssecia.bsky.social/post/3msdjlpgumd2c"}, {"timestamp": "2026-08-05T13:00:36.117Z", "date_only": false, "value": "2026-08-05T13:00:36.117690Z", "kind": "sighting", "label": "Seen", "source": "https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "ea20d4b9-a5d7-4a8a-b9aa-efcaa1e27da9", "content": "An unauthenticated attacker can read any file the service account can access on Gitea, the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.\n\nThe file-read flaw is tracked as CVE-2026-59774, rated Critical with a CVSS score of 9.8, and received its", "url": "https://thehackernews.com/2026/08/critical-gitea-flaw-let-unauthenticated.html"}, {"timestamp": "2026-08-06T12:15:34.905Z", "date_only": false, "value": "2026-08-06T12:15:34.905941Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/eyalestrin.bsky.social/post/3msfzg6qjv72y", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "d641158a-1754-4ee3-a228-79d3415c5c54", "content": "Gitea Vulnerability Enables Remote Code Execution (CVE-2026-59774) #patchmanagement", "url": "https://bsky.app/profile/eyalestrin.bsky.social/post/3msfzg6qjv72y"}, {"timestamp": "2026-08-07T10:04:24.530Z", "date_only": false, "value": "2026-08-07T10:04:24.530314Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/oryrocyfJIzbBSErsBZ4FQ1bOn27GRyNJiBDVHHRO9Y5Zzw", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "82d47f86-9cd8-496e-9507-de433e61a005"}, {"timestamp": "2026-08-13T09:00:10.412Z", "date_only": false, "value": "2026-08-13T09:00:10.412160Z", "kind": "sighting", "label": "Confirmed", "source": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-59774.yaml", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "2dbd93d0-d5af-4783-955b-da3d6d7f4a71", "url": "https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2026/CVE-2026-59774.yaml"}, {"timestamp": "2026-08-24T06:44:13.952Z", "date_only": false, "value": "2026-08-24T06:44:13.952103Z", "kind": "sighting", "label": "Seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774.rb", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "bdcd7133-dfa8-46f6-b422-bdb37b22ab03", "content": "{\"actions\": [], \"aliases\": [], \"arch\": \"\", \"author\": [\"xbow-security\", \"NightRang3r\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"Forgejo versions 7.0 through 15.0.5 and 16.0.0 through 16.0.1 are\\n          vulnerable to an arbitrary file read via the markup rendering API\\n          endpoint. The go-org library's default ReadFile callback\\n          (ioutil.ReadFile) is not overridden, allowing the #+INCLUDE directive\\n          to read arbitrary files accessible to the service user.\\n\\n          Valid credentials are required to access the API markup endpoint.\\n          Extracting sensitive files such as app.ini can expose INTERNAL_TOKEN\\n          and other secrets, potentially leading to remote code execution.\", \"disclosure_date\": \"2026-07-30\", \"fullname\": \"auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774\", \"is_install_path\": true, \"mod_time\": \"2026-08-12 10:32:09 +0000\", \"name\": \"Forgejo Arbitrary File Read via Org-mode Include\", \"needs_cleanup\": false, \"notes\": {\"Reliability\": [], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774.rb\", \"platform\": \"\", \"post_auth\": true, \"rank\": 300, \"ref_name\": \"gather/forgejo_orgmode_fileread_cve_2026_59774\", \"references\": [\"CVE-2026-59774\", \"GHSA-6v53-hr58-556r\", \"URL-https://codeberg.org/forgejo/forgejo/pulls/13682\"], \"rport\": 3000, \"session_types\": false, \"targets\": null, \"type\": \"auxiliary\"}", "url": "https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/forgejo_orgmode_fileread_cve_2026_59774.rb"}, {"timestamp": "2026-08-29T20:00:06.744Z", "date_only": false, "value": "2026-08-29T20:00:06.744692Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/CyberDispatch/2480", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "a91da1e1-e4e7-4b6a-a0a0-b1fac13ecc45", "content": "CVE-2026-59774, a critical Gitea flaw, lets attackers use a public repository to read any file accessible to the Gitea service account. Gitea says it could also be chained into command execution.", "url": "https://t.me/CyberDispatch/2480"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59774", "field": "containers.adp.1.metrics.1.other.content.timestamp"}, {"timestamp": "2026-10-14T00:00:00Z", "date_only": false, "value": "2026-10-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59774", "record": "FKIE_CVE-2026-59774", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T14:28:25.862Z", "date_only": false, "value": "2026-10-14T14:28:25.862Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-59774", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T14:28:25.862Z", "date_only": false, "value": "2026-10-14T14:28:25.862Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / Gitea", "record": "CVE-2026-59774", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:13:47.589Z", "date_only": false, "value": "2026-10-14T15:13:47.589Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CVE", "record": "CVE-2026-59774", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T15:17:20.677Z", "date_only": false, "value": "2026-10-14T15:17:20.677", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59774", "record": "FKIE_CVE-2026-59774", "field": "published"}, {"timestamp": "2026-10-14T16:10:05.973Z", "date_only": false, "value": "2026-10-14T16:10:05.973930Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtwp2j5wn2n", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "d8b120e5-2947-4b99-a1f6-07be6b4fcf09", "content": "CVE-2026-59774 - gitea\nGitea\u2019s document renderer can read any file the service can access when processing INCLUDE directives in public repositories. An attacker could view sensitive configuration files and, if they\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#gitea #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxtwp2j5wn2n"}, {"timestamp": "2026-10-14T16:52:03.664Z", "date_only": false, "value": "2026-10-14T16:52:03.664345Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxtz23q5342q", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "2aef5bb8-a920-4fe3-aa12-89899d676f95", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-59774: Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-sid\u2026\nCVSS 9.8\nhttps://beta.vulnsea.com/cve/CVE-2026-59774\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mxtz23q5342q"}, {"timestamp": "2026-10-14T18:08:55.401Z", "date_only": false, "value": "2026-10-14T18:08:55.401674Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxu5djo2fy2z", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "c65171ed-0424-4a40-842d-7dd95d656f4b", "content": "\ud83d\udea8 CVE-2026-59774 \u2014 CVSS 9.8 CRITICAL\n\nGitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint wi...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-59774\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxu5djo2fy2z"}, {"timestamp": "2026-10-14T19:50:55.157Z", "date_only": false, "value": "2026-10-14T19:50:55.157973Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441000550518808", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "ffe062de-32a8-4a62-b2ef-fb7dfebc29f0", "content": "CVE-2026-59774 Gitea Org-mode file disclosure and code execution Gitea's Org-mode markup renderer processes INCLUDE directives supplied to the repository markup endpoint without preventing access to server-side files. An unauthenticated attacker can use a suitable public repository to read files accessible to the Gitea service account. If the disclosed files include app.ini and its INTERNAL_TOKEN, the attacker can chain the disclosure with internal logger access to modify a Git hook and execute commands as the Gitea service account.\nhttps://www.cve.org/CVERecord?id=CVE-2026-59774https://github.com/go-gitea/gitea/security/advisories/GHSA-6v53-hr58-556rhttps://github.com/go-gitea/gitea/pull/38642https://blog.gitea.com/release-of-1.27.1/https://github.com/go-gitea/gitea/pull/38645https://github.com/go-gitea/gitea/releases/tag/v1.27.1#gitea #Gitea#CVE_2026_59774#bot", "url": "https://infosec.exchange/users/cve/statuses/117441000550518808"}, {"timestamp": "2026-10-15T03:56:54.937Z", "date_only": false, "value": "2026-10-15T03:56:54.937Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-59774", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-15T03:56:54.937Z", "date_only": false, "value": "2026-10-15T03:56:54.937Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-59774", "field": "containers.adp.1.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-15T04:18:24.663Z", "date_only": false, "value": "2026-10-15T04:18:24.663", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-59774", "record": "FKIE_CVE-2026-59774", "field": "lastModified"}, {"timestamp": "2026-10-15T07:57:54Z", "date_only": false, "value": "2026-10-15T07:57:54+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-59774", "field": "timestamps.asserted_at", "uuid": "ca327b59-f1b0-4514-b836-b599628a87ef", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-15T07:57:54Z", "date_only": false, "value": "2026-10-15T07:57:54+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-59774", "field": "timestamps.first_seen_at", "uuid": "ca327b59-f1b0-4514-b836-b599628a87ef", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-15T07:57:54Z", "date_only": false, "value": "2026-10-15T07:57:54+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-59774", "field": "status.status_updated_at", "uuid": "ca327b59-f1b0-4514-b836-b599628a87ef", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-15T07:57:54.199Z", "date_only": false, "value": "2026-10-15T07:57:54.199Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-59774", "field": "evidence.0.details.added_date", "uuid": "ca327b59-f1b0-4514-b836-b599628a87ef", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T08:00:02Z", "date_only": false, "value": "2026-10-16T08:00:02+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-59774", "field": "timestamps.recorded_at", "uuid": "ca327b59-f1b0-4514-b836-b599628a87ef", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-16T08:00:32.019Z", "date_only": false, "value": "2026-10-16T08:00:32.019761Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ca327b59-f1b0-4514-b836-b599628a87ef", "record": "CVE-2026-59774", "field": "creation_timestamp", "uuid": "8c246bed-fbd1-4239-b70f-5eabf7fbed55", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/ca327b59-f1b0-4514-b836-b599628a87ef"}]}