CVE-2026-22874 affects Gitea Open Source Git Server versions up to 1.26.2 by having incomplete SSRF protection mechanisms in webhook and migration allow-list filtering components. This weakness (CWE-918) could allow an attacker with low privileges to perform server-side request forgery attacks, potentially leading to high impact on confidentiality and integrity of the system. The vulnerability is critical with a CVSS 3.1 base score of 9.6, indicating network attack vector, low attack complexity, required privileges, no user interaction, and scope change. As of the published date, no official fix or patch has been disclosed by the vendor.

An attacker with limited privileges can exploit incomplete SSRF protections to send crafted requests from the vulnerable server, potentially accessing or manipulating internal resources or data. The vulnerability impacts confidentiality and integrity at a high level, but does not affect availability. This could lead to unauthorized data disclosure or modification within the affected Gitea server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider restricting access to webhook and migration features to trusted users only and monitor for suspicious activity related to these components. Avoid exposing the Gitea server to untrusted networks where possible.