PT-2026-63275

CVE-2026-23603

Published

2026-07-13

Updated

2026-08-26

Description by

CVSS 3.1

3.1

Low

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Gitea (affected versions not specified)

Description A blind Server-Side Request Forgery (SSRF) exists when the [oauth2 client] UPDATE AVATAR = true setting is enabled. The issue occurs because the server fetches the avatar URL provided by an OAuth2/OIDC provider—typically the picture claim—using the default Go HTTP client without applying outbound host or IP restrictions. A low-privileged user who can influence their own picture claim can force the Gitea server to make arbitrary outbound HTTP GET requests to loopback addresses, RFC 1918 private network addresses, and IPv4 link-local addresses such as 169.254.169.254.

Technical details include:

Vulnerable Function: oauth2UpdateAvatarIfNeed() in routers/web/auth/oauth.go and oauth2SignInSync() in routers/web/auth/oauth signin sync.go.
Vulnerable Variable: gothUser.AvatarURL.

While the issue is primarily blind because non-image responses are rejected, the impact increases if the server can reach cloud metadata services or internal services that return valid image data, which could then be stored as the user's avatar.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, disable the avatar synchronization feature by setting UPDATE AVATAR = false in the [oauth2 client] section of the configuration.

Exploitability

Exploit

Impacts

Researchers