The flaw is a Server‑Side Request Forgery identified as CWE‑918. It is triggered when a user performs a repository migration and the migration source returns an HTTP redirect. The Gitea server blindly follows that redirect, causing it to issue an HTTP request to an arbitrary URL supplied by the attacker. The effect is that the Gitea instance could initiate network requests to any address specified in the redirect, potentially revealing unintended outbound connectivity.

All deployments of the Gitea Open Source Git Server that include the repository migration feature and run a version earlier than 1.26.4 remain vulnerable. Versions 1.26.4 and newer include a fix that removes the unguarded redirect handling.

The CVSS score of 6.5 indicates a moderate severity. An EPSS score of less than 1% suggests a low probability of real‑world exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can trigger a repository migration request on the target instance, which typically entails having the ability to submit migration requests via the web interface or API.