Sanil18

**Name of the Vulnerable Software and Affected Versions** Gitea (affected versions not specified) **Description** The internal API HTTP client in `modules/private/internal.go` hardcodes `TLSClientConfig.InsecureSkipVerify = true`, which disables TLS certificate verification for outbound internal requests. When the `LOCAL ROOT URL` is configured to use HTTPS on a non-loopback target (such as in split-host or multi-pod topologies), the client accepts any TLS certificate, including self-signed ones. An attacker with an on-path position on the internal network segment can perform a man-in-the-middle (MITM) attack to intercept the connection and capture the static high-privilege `INTERNAL TOKEN` sent in the `X-Gitea-Internal-Auth` header. This token is the sole authentication mechanism for all `/api/internal/*` endpoints. A captured token allows an attacker to perform administrative actions, including shutting down or restarting the server, authorizing SSH keys, executing git commands, controlling repository hooks, sending emails, and generating Actions runner tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.