Gitea's outbound HTTP request filtering for webhooks and repository migration relies on an IP classifier that incorrectly permits certain address families, notably CGNAT (100.64.0.0/10), which is widely used in modern network environments such as Tailscale and AWS VPCs. This allows any authenticated user to create webhooks targeting internal CGNAT addresses and retrieve up to 1 MB of HTTP response data, which is logged and displayed to the webhook owner. Separately, the OpenID sign-in endpoint fetches user-supplied provider URLs without IP filtering or authentication, enabling unauthenticated SSRF attacks to arbitrary internal IPs. The root cause is the IP classifier's reliance on Go's net.IP methods that do not recognize all private or special-use address ranges. These vulnerabilities affect Gitea versions before 1.27.0 and were demonstrated on version 1.26.2.

An attacker with a logged-in account can exploit the webhook and repository migration SSRF to access internal network resources within CGNAT ranges, potentially exposing sensitive internal services. The OpenID SSRF vulnerability allows unauthenticated attackers to make arbitrary HTTP GET requests from the Gitea server to internal IP addresses, which can lead to information disclosure or internal network reconnaissance. The vulnerabilities do not directly allow code execution or denial of service but can facilitate further attacks by revealing internal infrastructure details.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to Gitea to trusted users and networks, disable OpenID sign-in if not required, and avoid running Gitea in network environments where internal CGNAT address spaces are accessible. Monitor vendor communications for official patches or updates addressing these SSRF issues.