CVE-2026-78231 Details
Description
When OpenID sign-in is enabled, Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to the caller-supplied OpenID provider endpoint during verification. An attacker controls the destination and much of the form body, allowing interaction with internal HTTP services reachable from the Gitea server. The response is not returned to the attacker, so the issue is blind SSRF; its impact depends on the services and network addresses the server can reach.
A blind server-side request forgery (SSRF) vulnerability has been identified in Gitea versions through 1.26.4, when OpenID sign-in is enabled. The issue arises because Gitea processes unauthenticated assertion parameters and sends an HTTP POST request to a destination controlled by the attacker, using the OpenID provider endpoint specified by the attacker. This request is made during the verification process, allowing the attacker to interact with internal HTTP services that are accessible from the Gitea server. The vulnerability is blind, meaning the response from the internal service is not returned to the attacker, and its impact varies depending on the services and network addresses the Gitea server can reach.
Users can upgrade to Gitea version 1.27.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/go-gitea/gitea/security/advisories/GHSA-8vmh-w35x-73qr | Gitea Limited | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | Gitea Limited |
Affected Products
| Product | Versions |
|---|---|
| Gitea | <= 1.26.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | Gitea Limited |