CVE-2026-82556: Server-Side Request Forgery in Forgejo

CVE-2026-82556 is a server-side request forgery vulnerability affecting Forgejo versions 15.0.0 through 15.0.4. The flaw is located in the net.LookupIP function within the Repository Migration Handler's allowlist migration check. An attacker can manipulate this function to cause the server to make unintended network requests. The vulnerability can be exploited remotely without privileges or user interaction. A patch identified by commit b313bb83f5ff22bcc0378e0e0ca7bbd58303f168 addresses the issue, but it introduces breaking changes and will not be backported to versions 15 or 16.

Successful exploitation allows an attacker to perform server-side request forgery, potentially causing the server to make unauthorized network requests. This could lead to information disclosure or interaction with internal systems. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low complexity, no privileges required, no user interaction, and low to low integrity and availability impacts.

A patch fixing this vulnerability is available in the commit b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply this patch to affected versions. Note that the patch introduces breaking changes and will not be backported to versions 15 or 16, so upgrading to a fixed version or applying the patch is necessary for remediation. Patch status beyond this is not explicitly confirmed; users should consult the Forgejo project for the latest remediation guidance.