Forgejo versions 15.0.11, 16.0.7, and 17.0.1 contain a server‑side request forgery flaw that lets an unauthenticated attacker trigger the server to perform blind GET requests by posting crafted OpenID identifier URLs to the /user/login/openid endpoint. The attacker can make the server query loopback interfaces, cloud metadata services, and other internal addresses, effectively scanning and probing the network. This results in potential exposure of internal services and network topology without needing authentication or elevated privileges.

The vulnerability affects Forgejo, the self‑hosted Git server, in the following releases: 15.0.11, 16.0.0 through 16.0.7, and 17.0.0 through 17.0.1. Users running any of these versions should confirm their exact patch level and plan an update accordingly.

The flaw carries a CVSS score of 6.9, indicating moderate severity. EPSS data is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploit activity has been recorded yet. The attack vector requires only a simple POST request to /user/login/openid and no prior authentication, making exploitation straightforward for an attacker who can reach the Forgejo instance over the network.