Forgejo EUVD-2026-68278

Exploitation requires a valid authenticated user session on the target Forgejo instance (CVSS PR:L). The vulnerable path is specifically triggered by initiating a repository migration - the attacker must have permission to use the migration feature, which is available to regular authenticated users by default. The attacker must also control a DNS-resolvable hostname to stage the DNS rebinding payload. Exploitation is constrained by: (1) authentication - unauthenticated external attackers cannot trigger the path without first obtaining an account, which is trivial if self-registration is enabled but a meaningful barrier if registration is invite-only or admin-controlled; (2) the migration feature must be enabled and not restricted to administrators only; (3) the Forgejo server must have network reachability to the internal target for the SSRF to yield useful data. Instances where migration is admin-only or where the server is network-isolated from sensitive internal resources are significantly less exposed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) indicates a network-reachable path with no attack complexity beyond holding an authenticated user account - a meaningful but real prerequisite on most self-hosted instances. Impact metrics VC:L/VI:L/VA:L reflect that SSRF typically yields partial internal network reconnaissance and limited service interaction rather than direct code execution. No EPSS score or KEV listing is present in the input, so exploitation frequency cannot be quantified; however, the public POC on Codeberg significantly lowers attacker skill requirements. The maintainer's explicit refusal to backport is the most operationally significant signal: every Forgejo deployment on v15 or v16 must self-apply the upstream commit or adopt compensating controls, with no routine package update available. The practical risk is highest on instances with open user registration, where an external attacker can trivially obtain the authenticated session needed to exploit the flaw, and where the Forgejo host has network access to internal services such as cloud metadata endpoints or private APIs.

An attacker who holds or creates an authenticated account on a Forgejo instance initiates a repository migration using a URL pointing to an attacker-controlled hostname. The attacker manipulates DNS so that the hostname resolves to an allowlisted external IP at the moment net.LookupIP performs the allowlist check, then resolves to an internal IP (such as a cloud metadata service or internal API) when the actual migration HTTP request is issued. Since POC code is publicly available on Codeberg issue #13433, the technique requires minimal attacker expertise beyond basic DNS control.