CVE-2026-22874

37th percentile - higher than 37% of all known CVEs

CVE-2026-22874 affects Gitea versions up to and including 1.26.2. The SSRF (Server-Side Request Forgery) protection in webhook and migration allow-list filtering is incomplete, potentially allowing an attacker to make unauthorized requests to internal network resources.

The risk involves exploiting incomplete SSRF protection to attack internal servers, which could lead to data leakage, privilege escalation, or further compromise of the infrastructure.

It is recommended to immediately upgrade Gitea to a version later than 1.26.2 that includes full SSRF protection. Until the update, restrict access to webhook and migration features and monitor network traffic for suspicious requests.