Gitea's repository migration URL validation can be bypassed when a hostname resolves to multiple IP addresses, some allowed and some blocked (e.g., loopback or private). The validation logic accepts the hostname if any resolved IP is allowed, but the actual git clone operation later resolves the hostname independently and may connect to an internal IP that should be blocked. This allows an authenticated user with repository migration permissions to perform SSRF by importing internal Git repositories into attacker-controlled repositories. The vulnerability is due to the mismatch between the allow/block list check and the DNS resolution performed during cloning.

An authenticated user with permission to create repository migrations can exploit this SSRF vulnerability to make the Gitea server connect to internal network resources that are normally blocked. This can lead to unauthorized access and import of internal Git repository contents into attacker-controlled repositories. The vulnerability does not affect confidentiality, integrity, or availability of Gitea itself directly but exposes internal network resources to unauthorized access via the migration feature.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict repository migration permissions to trusted users only and avoid enabling repository migration from untrusted sources. Monitor vendor channels for updates addressing this multi-answer DNS allow-list bypass issue.