CVE-2026-22874
Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.
- Affected products
- Gitea
- Fix
- Available
- CVSS 3.1
- 9.6 CRITICAL
- EPSS
- 0.5% (38th percentile)
- Weakness
- CWE-918
- NVD status
- Deferred
- Published
- 2026-07-03
CVE-2026-22874 at NVD
3 known exploits for CVE-2026-22874
Proof-of-concept code and exploit modules indexed by Sploitus