CVE-2026-22874
CriticalCVSS 9.6Exploitation Probability (EPSS)
Low risk37th percentile - higher than 37% of all known CVEs
Summary
CVE-2026-22874 affects Gitea versions up to and including 1.26.2. The SSRF (Server-Side Request Forgery) protection in webhook and migration allow-list filtering is incomplete, potentially allowing an attacker to make unauthorized requests to internal network resources.
Risk Assessment
The risk involves exploiting incomplete SSRF protection to attack internal servers, which could lead to data leakage, privilege escalation, or further compromise of the infrastructure.
Recommendation
It is recommended to immediately upgrade Gitea to a version later than 1.26.2 that includes full SSRF protection. Until the update, restrict access to webhook and migration features and monitor network traffic for suspicious requests.
Other vulnerabilities in Gitea
See all- CVE-2026-60004CriticalActively exploited
Gitea before version 1.27.1 allows remote code execution via the diffpatch API through Git hook installation.
- CVE-2026-58508Critical
Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation).
- CVE-2026-58443Critical
Public-only repository tokens can update private PR head branches.
- CVE-2026-58433Critical
The team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting. This means a user without proper permissions can change repository-team assignments.
- CVE-2026-56750Critical
Theft of the Remember-Me token in Gitea does not invalidate the attacker's session, allowing continued unauthorized access.
- CVE-2026-56654Critical
The vulnerability allows privilege escalation via access token scope escalation in the API.
- CVE-2026-56443Critical
A public-only scope token can bypass restrictions on limited-visibility owners (Repository and Package categories) — residual after CVE-2026-25714 / PR #37118.
- CVE-2026-55982Critical
The OIDC userinfo endpoint returns identity claims without enforcing API token scopes.
- CVE-2026-58426Critical
The vulnerability in Gitea Actions Artifacts V4 stems from HMAC ambiguity in signed URLs, allowing cross-repository artifact read and cross-task upload-state write.
- CVE-2026-27780Critical
A vulnerability in Gitea before version 1.26.0 fails to close the connection on bufio.Scanner errors while processing pre-receive hook input, allowing oversized input to bypass branch-protection checks.
Original NVD description (English source)
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS