Gitea versions before 1.27.0 harbor a server‑side request forgery flaw that lets an authenticated user supply arbitrary URLs to HTTP fetch functions in migration and OAuth avatar workflows. The URLs are passed to Go’s default http.Get, which uses the unmodified default DialContext, allowing the application to reach internal services, instance‑metadata endpoints, or even read local files such as the application configuration that contains database credentials and signing secrets. The data fetched is stored as migration release assets, enabling the attacker to later retrieve the exfiltrated content. Consequently, the vulnerability can compromise confidentiality of internal resources and credentials, and may facilitate further lateral movement.

The affected system is the Gitea code‑hosting platform, with all releases prior to 1.27.0 susceptible to the flaw. This includes any deployment using Gitea versions earlier than 1.27.0, regardless of hosting environment. The vulnerability is present on all operating systems and container images where these older releases are deployed.

The CVSS score of 8.3 indicates a high severity vulnerability. The EPSS score is currently unavailable, but the lack of a KEV listing and the requirement for an authenticated user suggest that exploitation is more likely in environments where privileged or developer accounts exist. Attackers can exploit the flaw by uploading migration or OAuth avatar URLs that point to internal endpoints; once the request is made the application returns the response content, which is then persisted for later download. As the permits reading sensitive configuration files, the risk is primarily in confidentiality breach, with possible lateral movement if credentials are compromised.