Two SSRF vulnerabilities exist in Gitea versions prior to 1.27.0. The first involves an IP address classifier that fails to block certain address families such as CGNAT (100.64.0.0/10), allowing authenticated users to create webhooks or perform repository migrations that access internal network resources. The second vulnerability allows unauthenticated attackers to cause server-side HTTP GET requests to arbitrary internal IP addresses via the OpenID sign-in form, which lacks IP filtering or authentication. Both vulnerabilities enable attackers to scan internal networks and retrieve data from internal hosts. These issues were confirmed on Gitea 1.26.2 with default configuration. The vulnerabilities are tracked as CVE-2026-58314 and have a CVSS 3.1 base score of 7.7 (high severity).

Successful exploitation allows attackers to perform server-side request forgery, enabling internal network scanning and data retrieval from internal hosts. The first vulnerability requires authentication and can be used to bypass IP filtering in webhooks and repository migrations. The second vulnerability can be exploited without authentication via the OpenID sign-in form. This can lead to exposure of sensitive internal network information and potentially facilitate further attacks within the internal network.

A patch is available in Gitea version 1.27.0 that addresses these SSRF vulnerabilities. Users should upgrade to version 1.27.0 or later to remediate these issues. No additional mitigation steps are indicated in the provided data.