CVE-2026-59765 is an SSRF vulnerability in Gitea prior to version 1.27.0. The flaw arises because certain migration and OAuth avatar update functions perform HTTP GET requests without host-based filtering, allowing attackers with migration permissions or control over OAuth sources to bypass SSRF protections. This enables access to internal network resources, cloud metadata services, and local files through the file:// scheme, potentially exposing sensitive information such as cloud instance metadata and secret configuration files. The vulnerability has a moderate severity rating and a CVSS 4.0 vector indicating network attack vector, low attack complexity, and partial privileges required. A patch is available to fix this issue.

Exploitation of this vulnerability can lead to unauthorized reading of internal network services, cloud metadata endpoints, and local files on the Gitea server. This may result in disclosure of sensitive data including cloud instance metadata and local configuration files containing secrets. The impact is limited by the requirement that the attacker must have migration permissions or control over admin-configured OAuth sources. There are no known exploits in the wild at this time.

A patch is available for Gitea version 1.27.0 and later that addresses this SSRF vulnerability by implementing proper host-based filtering and validation of HTTP requests in the affected code paths. Users should upgrade to version 1.27.0 or later to remediate this issue. No additional mitigations are specified by the vendor advisory.