A vulnerability was found in Forgejo up to 15.0.4. (CVE-2026-82556)

Forgejo versions up to 15.0.4 contain a vulnerability in the Repository Migration Handler component, specifically in the net.LookupIP function within services/migrations/allowlist/is_migrate_allowed.go. This flaw allows an attacker to perform server-side request forgery (CWE-918) remotely. The vulnerability has been assigned CVE-2026-82556 and has a CVSS 3.1 base score of 6.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). A patch identified by commit b313bb83f5ff22bcc0378e0e0ca7bbd58303f168 is available, but the maintainer does not intend to backport it to versions 15 or 16 due to breaking changes. No known exploits in the wild have been reported.

Successful exploitation of this vulnerability could allow an attacker with low privileges to remotely induce the server to make unauthorized requests, potentially leading to information disclosure, integrity loss, or availability impact. The CVSS score indicates low to medium severity with limited confidentiality, integrity, and availability impact.

A patch is available to fix this vulnerability, identified by commit b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply this patch to affected Forgejo instances. Note that the patch is not backported to versions 15 or 16 due to breaking changes, so upgrading to a patched version or applying the patch manually is necessary. No other vendor mitigation guidance is provided.