Gitea's internal API HTTP client disables TLS certificate verification by hardcoding InsecureSkipVerify=true without any configuration override. This affects deployments where internal API calls occur over a network rather than loopback, enabling attackers on the internal network to intercept and capture the static INTERNAL_TOKEN. This token grants access to sensitive operations such as server control, SSH key authorization, and git command execution. The vulnerability has existed since 2017 and affects all versions before 1.27.0. The CVSS 3.1 score is 7.5 (high severity) reflecting the attack vector over the internal network with high impact on confidentiality, integrity, and availability. A patch is available in version 1.27.0.

An attacker positioned on the internal network segment can perform man-in-the-middle attacks to capture the static high-privilege INTERNAL_TOKEN. This token allows unauthorized access to sensitive internal API operations including server control, SSH key authorization, and git command execution. The severity is high for deployments using split-host HTTPS internal API calls, while single-host loopback deployments have low or informational impact.

A fix is available in Gitea version 1.27.0 that removes the hardcoded InsecureSkipVerify=true setting. Users should upgrade to version 1.27.0 or later to remediate this vulnerability. Until upgraded, deployments using split-host HTTPS internal API calls are at risk and should consider network-level protections to prevent man-in-the-middle attacks.