Description
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.
Published: 2026-07-03
Score: 9.6 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in Gitea versions up to 1.26.2 allows remote attackers to perform server‑side request forgery by submitting webhook or migration requests containing URLs that bypass the allow‑list filter. The application blindly resolves and contacts these URLs, enabling attackers to reach internal addresses, exfiltrate data, or initiate denial‑of‑service conditions. This weakness is classified as CWE‑918.

Affected Systems

Gitea Open Source Git Server installations using any version through 1.26.2 are susceptible. Any deployment that exposes the webhook or migration APIs is at risk until the fix is applied.

Risk and Exploitability

The CVSS score of 9.6 classifies this issue as critical, though the EPSS score of less than 1% indicates a very low likelihood of exploitation in the current landscape. The vulnerability is not listed in the CISA KEV catalog, but that does not diminish the urgency of remediation. The expected attack path involves sending crafted webhook or migration requests from a remote host; the server will resolve the supplied URL and perform a request, potentially exposing internal services or causing service disruption.

Generated by OpenCVE AI on July 24, 2026 at 10:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Gitea to version 1.26.3 or later for the fixed allow‑list filtering.
  • If an immediate upgrade is not feasible, limit the webhook and migration endpoints to trusted IP ranges or internal networks.
  • Audit webhook configurations to whitelist only trusted URLs and disable the migration API if it is not required.

Generated by OpenCVE AI on July 24, 2026 at 10:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-2r5c-gw76-rh3w Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter
History

Tue, 07 Jul 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 06 Jul 2026 23:15:00 +0000

Type Values Removed Values Added
First Time appeared Gitea
Gitea gitea Open Source Git Server
Vendors & Products Gitea
Gitea gitea Open Source Git Server

Fri, 03 Jul 2026 20:45:00 +0000

Type Values Removed Values Added
Description Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.
Title Gitea webhook and migration allow-list filtering permits SSRF
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 9.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N'}

Subscriptions

Gitea Gitea Open Source Git Server
cve-icon MITRE

Status: PUBLISHED

Assigner: Gitea

Published:

Updated: 2026-07-07T17:00:28.552Z

Reserved: 2026-03-03T03:25:59.971Z

Link: CVE-2026-22874

cve-icon Vulnrichment

Updated: 2026-07-07T15:44:43.232Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-24T10:45:03Z

Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)