CVE-2026-22874 is a critical SSRF vulnerability (CWE-918) affecting Gitea Open Source Git Server versions up to and including 1.26.2. The issue arises from incomplete SSRF protection in webhook and migration allow-list filtering mechanisms, which could allow an attacker with low privileges to make the server perform unintended requests. The CVSS v3.1 base score is 9.6, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, scope change, and high impact on confidentiality and integrity. No official remediation or patch has been announced by the vendor as of the publication date.

Successful exploitation of this vulnerability could allow an attacker with limited privileges to perform server-side requests to internal or external systems that the server can access. This may lead to unauthorized access to sensitive information or manipulation of data, impacting confidentiality and integrity. Availability impact is not indicated. The vulnerability affects the security posture of Gitea instances by enabling potential SSRF attacks via webhook and migration features.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting webhook and migration functionalities to trusted users and networks, and monitor for unusual request patterns related to these features. Follow updates from the Gitea project for any forthcoming patches or official mitigations.