What is the CVSS score of CVE-2026-58418?

CVE-2026-58418 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-58418?

Yes, a patch is available for CVE-2026-58418. Update the affected software to the latest version immediately.

Gitea CVE-2026-58418

EUVD-2026-41602 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-03 Gitea

GHSA-rqhx-647v-wx32

SSRF Gitea Open Source Git Server Suse

6.5

CVSS 3.1 · Vendor: Gitea

Severity by source

Vendor (Gitea) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Migration feature is network-accessible and requires a low-privilege authenticated account (PR:L); SSRF yields internal data read only (C:H, I:N, A:N) with no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Primary rating from Vendor (Gitea).

CVSS VectorVendor: Gitea

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 03, 2026 - 22:14 vuln.today

DescriptionCVE.org

SSRF via HTTP Redirect in Repository Migration

AnalysisAI

Server-Side Request Forgery (SSRF) via HTTP redirect in Gitea's repository migration feature affects all versions through 1.25.4, allowing an authenticated attacker to coerce the Gitea server into issuing HTTP requests to arbitrary internal network destinations by supplying a crafted migration URL that redirects to an internal address. The CVSS score of 6.5 (C:H) reflects that successful exploitation can expose sensitive internal service responses - including cloud metadata endpoints, internal APIs, or other intranet services - to the attacker. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available in v1.26.3 and v1.26.4.

Technical ContextAI

CWE-918 (Server-Side Request Forgery) arises here because Gitea's repository migration subsystem performs server-side HTTP fetches of user-supplied URLs and follows HTTP redirects without validating that the redirect target remains within an approved network scope. This is a classic SSRF-via-open-redirect bypass: the initial URL may appear legitimate, but the server transparently follows a 301/302 redirect to an internal address (e.g., RFC1918 ranges, loopback, or cloud IMDS endpoints such as 169.254.169.254). The affected product is confirmed by CPE cpe:2.3:a:gitea:gitea_open_source_git_server:*:*:*:*:*:*:*:*, covering Gitea Open Source Git Server across all versions up to and including 1.25.4 per EUVD-2026-41602. The vulnerability is scoped to the migration/import feature, which is a standard capability of the platform.

RemediationAI

Upgrade to Gitea v1.26.3 or v1.26.4, both of which contain the fix per the vendor release announcements at https://github.com/go-gitea/gitea/releases/tag/v1.26.4 and https://blog.gitea.com/release-of-1.26.3-and-1.26.4/. The upstream code fix is tracked at https://github.com/go-gitea/gitea/pull/38108 - note that this reference points to a pull request rather than a tagged release, so the patched version is confirmed via the release references rather than the PR alone. As a compensating control where immediate upgrade is not possible, administrators should restrict repository migration permissions to trusted users only or disable the migration feature entirely via Gitea's admin panel (Administration > Settings > Repository > Disable Repository Migrations); disabling migration eliminates the vulnerable code path entirely at the cost of preventing legitimate repository imports. Additionally, network-level controls blocking the Gitea server process from initiating outbound connections to RFC1918 ranges and cloud metadata IPs (e.g., 169.254.169.254) will substantially reduce the blast radius if exploitation occurs, though this requires infrastructure-level firewall or egress filtering configuration.