CVE-2026-34966

Name of the Vulnerable Software and Affected Versions Gitea versions prior to 1.27.0

Description Authenticated attackers can bypass server-side request forgery (SSRF) protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths. The issue occurs because the application uses Go's default http.Get without a custom DialContext. Attackers can provide arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to access internal services, cloud instance-metadata endpoints, or read local files, including application configurations containing database credentials and signing secrets. The exfiltrated data can be saved as migration release assets for later retrieval.

Recommendations Update Gitea to version 1.27.0 or later.