Skip to content
Threat Feed
Subscribe

Tag

Git-Platform

1 brief RSS
critical advisory

Gitea Incomplete SSRF Protection in Webhook and Migration Allow-list

An incomplete Server-Side Request Forgery (SSRF) protection in Gitea versions prior to 1.26.3 allows authenticated users to bypass the allow-list in webhook delivery and repository migrations, enabling internal network probing and data exfiltration from sensitive services like cloud metadata endpoints.

Gitea ssrf web-application data-exfiltration vulnerability github authorization-bypass information-disclosure api +5
4t 1c 1i