Gitea versions before 1.26.4 validate the initial URL provided to the repository migration API to prevent access to internal IP addresses. However, if the initial URL points to an attacker-controlled server that issues an HTTP 302 redirect to an internal address (e.g., 127.0.0.1), Gitea follows the redirect without performing a second validation. This flaw allows a low-privilege user to exploit the migration endpoint to access internal services behind the Gitea server, bypassing IP restrictions and potentially exfiltrating sensitive data from internal-only services.

An attacker with a regular user account on the Gitea instance can exploit this vulnerability to access internal services that are not normally reachable from outside the host. This can lead to unauthorized disclosure of sensitive internal data. The vulnerability does not require administrative privileges and does not impact integrity or availability directly but results in confidentiality loss.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user access to the repository migration endpoint to trusted users only and monitor for suspicious migration requests. Network-level controls to prevent Gitea from accessing internal-only IP addresses via redirects may help mitigate risk. Avoid using untrusted URLs for repository migration.