PT-2026-52217 · Gitea · Gitea

Jlleitschuh

·

CVE-2026-22874

·

Published

2026-05-21

·

Updated

2026-07-30

CVSS v3.1

9.6

Critical

VectorAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.3
Description Incomplete Server-Side Request Forgery (SSRF) protection exists within the webhook and migration allow-list filtering. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.
Recommendations Update to a version newer than 1.26.2.

Exploit

Fix

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2026-09234
CVE-2026-22874
GHSA-2R5C-GW76-RH3W
GO-2026-6030
OPENSUSE-SU-2026:21483-1

Affected Products

Gitea