PT-2026-52217

CVE-2026-22874

Published

2026-05-21

Updated

2026-10-25

Description by

CVSS 3.1

9.6

Critical

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.26.3

Description Incomplete Server-Side Request Forgery (SSRF) protection exists within the webhook and migration allow-list filtering. SSRF is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to a version newer than 1.26.2.

Exploitability

Exploit

Fix

Impacts

Researchers

Jlleitschuh

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers