Gitea EUVD-2026-41602

Exploitation requires a valid Gitea user account with permission to use the repository migration feature (CVSS PR:L - low-privilege authenticated access). The attack is only possible when the repository import/migration functionality is enabled and accessible to the attacker's account; Gitea administrators can restrict or disable this feature. Limiting factors include: authentication is mandatory (no unauthenticated exploitation path exists per the CVSS PR:L metric), the Gitea server must be able to reach the internal target from its network position (cloud metadata or internal services must be network-reachable from the Gitea host), and the attacker must control an intermediary server capable of issuing the redirect. Deployments where migration is restricted to administrators only, or where egress filtering prevents the Gitea process from reaching internal network ranges, are not exploitable.

The CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N indicates network-reachable exploitation with low complexity, but critically requires a valid authenticated user account (PR:L), which meaningfully narrows the realistic attacker population compared to unauthenticated SSRF. The high confidentiality impact (C:H) reflects the potential to read internal service responses that are never intended to be externally accessible. No EPSS score was provided in the input data - exploitation probability is therefore unknown. No KEV listing exists, and no public POC has been confirmed, meaning this is assessed as a theoretical risk based on vulnerability class rather than observed exploitation. Real-world priority depends heavily on deployment context: Gitea instances exposed to untrusted authenticated users (e.g., public or multi-tenant deployments) face meaningfully higher risk than private, single-organization instances where all users are already trusted. The S:U (unchanged scope) designation in the CVSS vector is consistent with the impact being contained to data the Gitea server process can reach, without privilege escalation to other systems. No conflicting signals are present, though absence of EPSS data limits confidence in exploitation likelihood.

An attacker with a low-privilege Gitea account navigates to the repository migration interface and submits a migration URL pointing to an attacker-controlled server. That server responds with an HTTP 301 redirect targeting an internal address, such as the AWS EC2 instance metadata service at http://169.254.169.254/latest/meta-data/ or an internal Kubernetes API endpoint. Gitea's migration engine follows the redirect server-side and the response content - potentially including credentials, tokens, or sensitive configuration - is returned to the attacker. No public POC has been identified at time of analysis.