Gitea CVE-2026-96400

Exploitation requires a specific non-default configuration: [migrations] ALLOWED_DOMAINS must be set to a matching wildcard entry (e.g., * or *.hostname); the default empty ALLOWED_DOMAINS is explicitly NOT affected. The attacker must be an authenticated Gitea user permitted to start migrations (PR:L). The flaw specifically defeats the intended ALLOW_LOCALNETWORKS = false protection because the local-network block list did not include reserved/link-local ranges (e.g., 169.254.0.0/16) and allow-list hostname matching was honored regardless of the resolved address. Limiting factors: requires authenticated migration privileges, requires an administrator to have weakened the allow list to a wildcard, and impact is bounded to reaching/reading addresses from the server (no code execution or data modification); real-world severity escalates mainly where a cloud metadata service (169.254.169.254) is reachable from the Gitea host.

This is a genuinely low-to-moderate priority SSRF (CWE-918), not an urgent critical issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N = 4.3 Medium) correctly reflects a network-reachable but privilege-gated flaw with only limited confidentiality impact and no integrity or availability impact. Crucially, the vulnerability is NOT present in default configurations: it requires an administrator to have set [migrations] ALLOWED_DOMAINS to a permissive matching entry such as * or a hostname wildcard, which materially shrinks the exploitable population. No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so there is no signal of active or probable near-term exploitation - this appears to be a vendor/researcher-disclosed hardening issue rather than an attacker-driven one. Signals are internally consistent: PR:L matches the description's 'a user who can start migrations,' and C:L/I:N/A:N matches an SSRF that lets an attacker reach internal/link-local addresses (e.g., 169.254.169.254 cloud metadata) and read responses. The one caveat worth verifying with the vendor: SSRF to a cloud metadata endpoint can, depending on the environment, yield IAM credentials, which in practice may exceed a 'Low' confidentiality rating - the base score assumes only limited information disclosure and does not account for environment-specific escalation.

On a Gitea instance (≤1.27.3) whose administrator has set [migrations] ALLOWED_DOMAINS to * or a hostname wildcard, an authenticated user with migration rights starts a repository migration pointing at a URL that resolves to a reserved/link-local address such as http://169.254.169.254/. Because the local-network block list did not cover these ranges and the host was accepted on allow-list match alone (even with ALLOW_LOCALNETWORKS = false), the Gitea server issues the request and returns the response, exposing cloud-instance metadata or other internal services. No public exploit code was identified at time of analysis.