Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)

Description

Affected Products

Vendor	Product	Versions
gitea	gitea open source git server	0

References

https://github.com/go-gitea/gitea/security/advisories/GHSA-j72v-mjr6-3424(vendor-advisory)
https://github.com/go-gitea/gitea/releases/tag/v1.27.0(release-notes)
https://blog.gitea.com/gitea-1.27.0-is-released/(release-notes)

Related News (1 articles)

Tier C

VulDB12d ago

CVE-2026-58508 | Gitea up to 1.26.4 Migration/Mirror server-side request forgery

→ No new info (linked only)

CVSS 3.19.1 CRITICAL

VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CISA KEV❌ No

Actively exploited❌ No

Patch available

https://github.com/go-gitea/gitea/security/advisories/GHSA-j72v-mjr6-3424

CWECWE-284

PublishedAug 13, 2026

Trending Score11

Source articles1

Independent1

Info Completeness0/14

Missing: cve_id, title, description, vendor, product, versions, cvss, epss, cwe, kev, exploit, patch, iocs, mitre_attack

Community Vote

0 upvotes0 downvotes

No votes yet

Related CVEs (5)

CRITICALCVE-2026-20896EXPKEV

Gitea Docker image trusts spoofable reverse-proxy headers by default

Trending: 144

CRITICALCVE-2026-58433

Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

Trending: 13

HIGHCVE-2026-58417

REST API exposes organization membership of private organizations to public

Trending: 11

HIGHCVE-2026-58438

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

Trending: 11

HIGHCVE-2026-58427

Private org member list leaked via /members API endpoint — incomplete fix for PR #38145

Trending: 8

Pin to Dashboard

Verification

State: unverified

Confidence: 0%

Vulnerability Timeline

CVE Published

Aug 13, 2026

Discovered by ZDM

Aug 13, 2026

Patch Available

Aug 14, 2026