The vulnerability lies in Gitea's migration feature. When the ALLOWED_DOMAINS option is enabled, a domain name that matches the allow list is accepted without verifying the resolved IP address against the local network restriction. This allows an attacker who can initiate a migration and control DNS for an allowed hostname to point that hostname to a loopback or private address and force Gitea to issue a request to an internal service, thereby bypassing the ALLOW_LOCALNETWORKS protection. The flaw is essentially a server‑side request forgery.

Gitea serversAINS setting configured are affected. Any instance running Gitea with ALLOWED_DOMAINS enabled is potentially vulnerable, irrespective of the exact Gitea version; the CVE statement does not specify a version scope.

Exploitation requires the attacker to have sufficient privileges to start a migration and to control DNS for a hostname listed in ALLOWED_DOMAINS. No additional network or administrative privileges are needed beyond these. The CVSS score is 7.7, indicating a high‑severity vulnerability. The EPSS score is <1%, indicating a very low probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog. When successfully exploited, an attacker can reach private services on the Gitea host, potentially leaking sensitive data or affecting other internal systems.