Critical Gitea flaw allows unauthenticated attackers to read server files

A flaw in Gitea versions 1.22.1 through 1.27.0 allows an unauthenticated attacker to read files accessible to the Gitea service account. A public repository and crafted Org-mode markup are sufficient; no login or repository write access is required. The flaw is fixed in Gitea 1.27.1.