EUVD-2026-41618
GHSA-2r5c-gw76-rh3w
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Network-reachable feature abused by an authenticated low-priv user (PR:L); scope changes as requests hit other systems (S:C); SSRF primarily leaks internal data (C:H) with limited integrity impact (I:L) and no availability effect.
Primary rating from Vendor (Gitea).
CVSS VectorVendor: Gitea
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Lifecycle Timeline
1DescriptionCVE.org
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.
AnalysisAI
Server-side request forgery in Gitea versions up to and including 1.26.2 lets authenticated users abuse incomplete allow-list filtering in the webhook and repository-migration features to coerce the server into making requests to internal or otherwise restricted network destinations. Because the existing SSRF protection is incomplete rather than absent, attackers can craft addresses that bypass the allow-list checks to reach services that should be unreachable from outside. No public exploit identified at time of analysis, and the flaw is not listed in CISA KEV; a vendor patch is available in Gitea 1.26.3.
Technical ContextAI
Gitea is a self-hosted, open-source Git service (cpe:2.3:a:gitea:gitea_open_source_git_server) written in Go, comparable to a lightweight GitHub/GitLab. Two of its features make outbound HTTP requests on behalf of users: webhooks (which POST event payloads to user-configured URLs) and repository migration/mirroring (which fetches a remote repository from a user-supplied URL). Both are supposed to enforce an allow-list/deny-list to prevent requests to internal hosts, but this is a classic CWE-918 (SSRF) case where the URL/host validation is incomplete - likely bypassable via alternate IP encodings, DNS rebinding, redirects, or address forms the filter fails to normalize - allowing the trusted server to be turned into a request proxy into the internal network.
RemediationAI
Vendor-released patch: upgrade to Gitea 1.26.3 or later (1.26.4 is also available per the release blog), which corrects the incomplete allow-list filtering in the webhook and migration code paths per pull requests https://github.com/go-gitea/gitea/pull/38173 and https://github.com/go-gitea/gitea/pull/38059. If immediate upgrade is not possible, reduce exposure by disabling or tightly restricting who can create webhooks and initiate repository migrations (limit these to trusted admins), disabling open self-registration so untrusted users cannot obtain the authenticated foothold this requires, and network-segmenting the Gitea host so it cannot reach sensitive internal endpoints (cloud metadata services like 169.254.169.254, internal admin panels, databases) - the trade-off is that legitimate internal webhook targets and internal mirror sources will also be blocked. Review advisory GHSA-2r5c-gw76-rh3w for authoritative guidance.
Broken access control in Gitea's Composer package registry (versions up to and including 1.26.1) lets remote attackers r
Gitea before 1.16.7 does not escape git fetch remote. Rated high severity (CVSS 7.5), this vulnerability is remotely exp
The git hook feature in Gitea 1.1.0 through 1.12.5 might allow for authenticated remote code execution in customer envir
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gitea Gitea
Reverse-proxy authentication bypass in the official Gitea Docker image (versions up to and including 1.26.2) allows any
Container escape in Gitea act_runner (Docker backend, through act 0.262.0) lets an authenticated user with workflow-exec
models/repo_mirror.go in Gitea before 1.7.6 and 1.8.x before 1.8-RC3 mishandles mirror repo URL settings, leading to rem
Server-side request forgery and internal repository exfiltration in Gitea before 1.27.0 lets a low-privileged authentica
An issue was discovered in Gitea through 1.11.5. Rated high severity (CVSS 7.5), this vulnerability is remotely exploita
Missing Authorization in GitHub repository go-gitea/gitea prior to 1.16.4. Rated high severity (CVSS 7.1), this vulnerab
Open Redirect on login in GitHub repository go-gitea/gitea prior to 1.16.5. Rated medium severity (CVSS 6.1), this vulne
Authenticated command injection in Dokploy (self-hostable PaaS) versions 0.29.3 through 0.29.12 lets a low-privileged us
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 16.1 | Affected |
| SUSE Linux Enterprise Server for SAP applications 16.1 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP5 | Affected |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | Affected |
| openSUSE Leap 15.5 | Affected |
| openSUSE Leap 15.6 | Affected |
Share
External POC / Exploit Code
Leaving vuln.today