CVE-2026-22874

Published: Jul 3, 2026Modified: Jul 7, 2026Deferred

9.6

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Exploitability: 3.1 / Impact: 5.8

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2 (Secondary)

Description

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (6)

https://blog.gitea.com/release-of-1.26.3-and-1.26.4/

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/38059

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/pull/38173

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/releases/tag/v1.26.3

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w

Source: 88ee5874-cf24-4952-aea0-31affedb7ff2

https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

Timeline

No history available yet.