{"id":"EUVD-2026-41618","enisaUuid":"8b7f39be-471a-36d0-a1d6-2393346c3404","description":"Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.","datePublished":"Jul 3, 2026, 8:19:31 PM","dateUpdated":"Jul 7, 2026, 5:00:28 PM","baseScore":9.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w\nhttps://github.com/go-gitea/gitea/pull/38173\nhttps://github.com/go-gitea/gitea/pull/38059\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","aliases":"CVE-2026-22874\nGHSA-2r5c-gw76-rh3w\n","assigner":"Gitea","epss":0.46,"enisaIdProduct":[{"id":"bf0f541c-83a7-3674-908f-75af9ec02eb2","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"enisaIdVendor":[{"id":"bdd5c226-3a98-34cb-9ca7-4f166788b445","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"823fa2ce-012d-31f7-974c-8e83d6bb6277","vulnerability":{"id":"CVE-2026-22874","description":"Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.","datePublished":"Jul 3, 2026, 8:19:31 PM","dateUpdated":"Jul 7, 2026, 5:00:28 PM","status":"PUBLISHED","baseScore":9.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w\nhttps://github.com/go-gitea/gitea/pull/38173\nhttps://github.com/go-gitea/gitea/pull/38059\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","enisa_id":"EUVD-2026-41618\n","assigner":"Gitea","epss":0.46,"dataProcessed":"Nov 2, 2026, 7:20:18 AM","vulnerabilityProduct":[{"id":"eb4b562b-9e88-37d0-94b5-c1a31728766a","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"vulnerabilityVendor":[{"id":"ba9d9829-6434-3d90-90aa-25b639d1ebd7","vendor":{"name":"Gitea"}}]}},{"id":"baf253db-a6fe-3d51-874b-848d3c4555e2","vulnerability":{"id":"GHSA-2r5c-gw76-rh3w","description":"Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter","datePublished":"Jul 21, 2026, 8:27:17 PM","dateUpdated":"Jul 21, 2026, 8:27:17 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2r5c-gw76-rh3w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-22874\nhttps://github.com/go-gitea/gitea/pull/38059\nhttps://github.com/go-gitea/gitea/pull/38173\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\n","enisa_id":"EUVD-2026-41618\n","aliases":"GHSA-2r5c-gw76-rh3w\nCVE-2026-22874\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}