{"id":"EUVD-2026-53617","enisaUuid":"23655ab2-9559-3845-8fca-402f5567ab4a","description":"Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go\u0027s default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.","datePublished":"Aug 5, 2026, 8:28:57 PM","dateUpdated":"Oct 8, 2026, 3:22:30 PM","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc\nhttps://github.com/go-gitea/gitea/commit/b969123b7fac51c88daab5cb64e5b2f4abd53288\nhttps://www.vulncheck.com/advisories/gitea-prior-to-ssrf-via-migration-uri-fetch-bypass\n","aliases":"CVE-2026-34966\nGHSA-685p-fm6j-c445\n","assigner":"VulnCheck","epss":0.39,"enisaIdProduct":[{"id":"7bbf474c-7674-3b88-bcbc-f4e54506eb6c","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"patch: 1.27.0"},{"id":"e417e142-042b-353b-b651-b5c294748e79","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.4"}],"enisaIdVendor":[{"id":"20302641-288e-3d80-acac-2fd0e4c3b205","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"a9b52d70-7cb4-3df1-887d-04605e4654a6","vulnerability":{"id":"CVE-2026-34966","description":"Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go\u0027s default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.","datePublished":"Aug 5, 2026, 8:28:57 PM","dateUpdated":"Oct 8, 2026, 3:22:30 PM","status":"PUBLISHED","baseScore":8.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","references":"https://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc\nhttps://github.com/go-gitea/gitea/commit/b969123b7fac51c88daab5cb64e5b2f4abd53288\nhttps://www.vulncheck.com/advisories/gitea-prior-to-ssrf-via-migration-uri-fetch-bypass\n","enisa_id":"EUVD-2026-53617\n","assigner":"VulnCheck","epss":0.39,"dataProcessed":"Nov 7, 2026, 7:22:53 AM","vulnerabilityProduct":[{"id":"2cb90746-b0a1-3f11-8259-202ee07de3e8","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"patch: 1.27.0"},{"id":"9cbcc301-71ff-33f1-891e-7e02f3ef9561","product":{"name":"Gitea","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.4"}],"vulnerabilityVendor":[{"id":"a9f2a51f-6b4c-3b64-9edf-36da71286f6c","vendor":{"name":"Gitea"}}]}},{"id":"b38bb91c-a6ec-380a-a0a0-f5f210a17a56","vulnerability":{"id":"GHSA-685p-fm6j-c445","description":"Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go\u0027s default http.Get without a custom DialContext. Attackers can supply arbitrary URLs through release asset download URLs, pull-request patch URLs, or OAuth avatar endpoints to reach internal services, cloud instance-metadata endpoints, or read local files such as the application configuration containing database credentials and signing secrets, with exfiltrated content persisted as migration release assets for later retrieval.","datePublished":"Aug 5, 2026, 9:31:39 PM","dateUpdated":"Aug 5, 2026, 9:31:39 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-2wm4-vwp6-v7xc\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-34966\nhttps://github.com/go-gitea/gitea/commit/b969123b7fac51c88daab5cb64e5b2f4abd53288\nhttps://github.com/go-gitea/gitea\nhttps://www.vulncheck.com/advisories/gitea-prior-to-ssrf-via-migration-uri-fetch-bypass\n","enisa_id":"EUVD-2026-53617\n","aliases":"CVE-2026-34966\nGHSA-685p-fm6j-c445\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:49 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}