This vulnerability (CVE-2026-58418) in Gitea Open Source Git Server involves SSRF via HTTP redirect in the repository migration functionality. An attacker with low privileges can exploit this to cause the server to perform unintended HTTP requests, potentially exposing sensitive information. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The vendor has not yet provided an official fix or remediation level. No known active exploitation has been reported.

The vulnerability allows an attacker with limited privileges to induce the server to make HTTP requests to arbitrary locations, potentially exposing sensitive internal resources or data (high confidentiality impact). There is no impact on data integrity or availability. No known exploits in the wild have been reported, so the immediate risk is moderate.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to repository migration features to trusted users only and monitor for unusual outbound HTTP requests related to migration activities.