An improper validation of migration URLs allowed Gitea to treat reserved and link‑local addresses as legitimate when the ALLOWED_DOMAINS setting contained a wildcard such as * or a hostname pattern. This flaw enabled a Server‑Side Request Forgery that bypasses the service’s local‑network filter, allowing an attacker to reach internal endpoints like 169.254.169.254. The weakness is an instance of CWE‑918, leading to potential unauthorized access to internal metadata services or other sensitive resources.

Any running instance of Gitea with the ALLOWED_DOMAINS configuration set to * or a host wildcard, in versions before the 28.0.0 release, is affected. The vulnerability remains in the default configuration only when ALLOWED_DOMAINS is explicitly modified, so installations that leave the setting empty are not impacted. The issue applies to the Gitea server component.

Exploitability depends on user permissions; an attacker must be able to initiate a migration action on the server. Once that privilege is present, the flaw can force the server to connect to arbitrary internal addresses, exposing internal services. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, but the lack of network restrictions combined with the potential to reach sensitive internal endpoints remains a concern. The CVSS score of 4.3 classifies the severity as moderate, suggesting a medium risk scenario.