Threats Tagged 'ghsa-x77v-q46j-393g'
View all threats tagged with 'ghsa-x77v-q46j-393g'. Filter and sort to focus on specific types of threats.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threats Tagged 'ghsa-x77v-q46j-393g'
Click on any threat for detailed analysis and mitigation recommendations
Gitea: Blind SSRF in OAuth2 avatar synchronization via unvalidated OIDC picture claim (CVE-2026-23603)CVE-2026-23603 0 Gitea versions prior to 1.27.0 have a blind Server-Side Request Forgery (SSRF) vulnerability in the OAuth2 avatar synchronization feature when the setting UPDATE_AVATAR is enabled. The vulnerability arises because Gitea fetches the avatar URL from the OAuth2/OIDC provider's picture claim using an unvalidated HTTP GET request without restricting outbound hosts or IPs. A low-privileged user who can control their picture claim can cause the Gitea server to make arbitrary HTTP requests to internal or private network addresses. This can lead to internal network probing or interaction with localhost-only services. The vulnerability is blind because non-image responses are discarded, but if an internal service returns a valid image, it may be stored as the user's avatar, allowing limited data retrieval. Join the discussion | GCVE Database | 07/21/2026, 20:22:23 UTC Added: 07/22/2026, 00:11:39 UTC |
Showing 1 to 1 of 1 result