The vulnerability is a Server‑Side Request Forgery identified as CWE‑918, triggered when a repository migration source supplies an HTTP redirect that the Gitea server follows without validation. The result is that the Gitea instance may issue HTTP requests to any URL specified in the redirect, allowing an attacker to direct the Gitea process to reach internal or external network resources. The likely attack vector is a malicious redirect returned by the chosen migration source.

All deployments of the Gitea Open Source Git Server that include the repository migration feature and run a version that does not include the patch remain vulnerable. A patched release has been made available (as referenced in the release notes) that removes the unguarded redirect handling.

The CVSS score of 6.5 reflects a moderate severity, while an EPSS score of less than 1% indicates a low probability of real‑world exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker can trigger a repository migration request, which generally presupposes the ability to submit migration requests via the web interface or an API.