{"id":"CVE-2026-96400","revision":"a73372b4795042cf9f9b1b94bfb7d773","records":[{"revision":"a73372b4795042cf9f9b1b94bfb7d773","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-96400","aliases":[],"title":"Gitea migration SSRF to reserved addresses through ALLOWED_DOMAINS","description":"With `[migrations] ALLOWED_DOMAINS` set to a matching entry such as `*` or a hostname wildcard, Gitea's migration URL validation could permit reserved and link-local addresses, such as `169.254.169.254`, even when `ALLOW_LOCALNETWORKS = false`. The local-network block list did not cover these ranges, and a hostname matching the allow list was accepted regardless of its resolved address. A user who can start migrations on such an instance could reach these addresses from the Gitea server; the default empty `ALLOWED_DOMAINS` configuration is not affected.","state":0,"publishedAt":"2026-10-06T19:25:23.261+00:00","modifiedAt":"2026-10-07T11:35:27.28+00:00","affected":[{"ecosystem":"Vendor product","name":"gitea.dev","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Gitea\",\n                    \"product\": \"Gitea\",\n                    \"packageName\": \"gitea.dev\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"lessThanOrEqual\": \"1.27.3\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-54w9-6cc5-9wj9","https://github.com/go-gitea/gitea/pull/39426","https://blog.gitea.com/release-of-28.0.0/","https://github.com/go-gitea/gitea/releases/tag/v28.0.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96400","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-96400","identifiers":["CVE-2026-96400"]},"retained":false,"historicalAffected":[]}],"coverage":[]}