Gitea before version 1.27.0 performs URL allow/block validation on repository migration URLs but does not restrict the Git client from following HTTP redirects. An authenticated user with low privileges can submit a public Git URL that redirects to an internal or blocked Git repository, causing the Git client to fetch data from the redirected internal endpoint. This enables exfiltration of internal Git repositories during migration or mirror fetch operations. The vulnerability is tracked as CVE-2026-57894 with a CVSS 3.1 score of 8.5 (high severity). No evidence of unauthenticated exploitation or remote code execution exists. A patch is available to fix this issue.

This vulnerability allows low-privileged authenticated users to bypass URL allow/block policies and exfiltrate internal Git repository data by exploiting HTTP redirects during repository migration or mirror fetch operations. The impact is high for internet-facing Gitea instances with migration enabled, potentially exposing sensitive internal repositories and secrets. It does not directly enable remote code execution or unauthenticated access but can lead to critical data exposure if sensitive internal data is leaked.

A patch is available for Gitea version 1.27.0 and later that addresses this vulnerability. Users should upgrade to version 1.27.0 or newer to remediate this issue. Until patched, restrict repository migration and mirror fetch operations to trusted users and carefully control access to internal Git repositories. Monitor and review migration URLs and redirects to detect potential abuse.