Gitea before version 1.27.0 has a blind SSRF vulnerability (CVE-2026-23603) in its OAuth2 avatar synchronization feature when UPDATE_AVATAR is enabled. The vulnerability occurs because Gitea fetches the avatar URL from the OAuth2/OIDC provider's picture claim without validating or restricting outbound HTTP GET requests. A low-privileged user controlling their picture claim can induce the server to make arbitrary HTTP requests to internal or private network hosts. Although the vulnerability is blind (non-image responses are discarded), if an internal service returns a valid image, it may be saved as the user's avatar, allowing limited data retrieval or internal network probing. This vulnerability is classified under CWE-918 (Server-Side Request Forgery) and has a CVSS 3.1 base score of 3.1 (low severity). A patch is available in Gitea version 1.27.0.

An attacker with low privileges who can control their OAuth2/OIDC picture claim can cause the Gitea server to make arbitrary HTTP requests to internal or private network addresses. This can lead to internal network reconnaissance or interaction with localhost-only services. The vulnerability does not allow direct data exfiltration or code execution but may enable limited data retrieval if internal services respond with valid images. The overall impact is limited and rated as low severity.

A fix for this vulnerability is available in Gitea version 1.27.0. Users should upgrade to version 1.27.0 or later to remediate this issue. Until patched, consider disabling the UPDATE_AVATAR setting to prevent automatic avatar synchronization from OAuth2/OIDC providers. No other specific mitigations are indicated by the vendor advisory.