Executive brief
Gitea is an open-source platform for hosting software development projects. A security flaw in its repository migration tool allows users to bypass network restrictions and access internal services that should be private. An attacker could use this to steal confidential data from internal servers or access sensitive cloud configuration details, potentially leading to a breach of internal infrastructure.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Gitea's repository migration endpoint (`POST /api/v1/repos/migrate`). While Gitea validates the initial URL to block internal IP ranges (loopback and RFC1918), it fails to re-validate the destination if the initial request is met with an HTTP 302 redirect. An attacker can provide a URL to a malicious server that redirects Gitea to an internal service (e.g., localhost or cloud metadata endpoints). This allows an authenticated user to exfiltrate data from internal Git repositories or interact with internal APIs. The vulnerability is patched in version 1.26.4.
Affected products
- Gitea Gitea < 1.26.3
Timeline
- 2026-07-01: disclosed
- 2026-07-03: advisory: NVD publication date
- 2026-07-21: patched: GitHub Advisory published/updated