What is CVE-2026-34966?

CVE-2026-34966 is a high-severity vulnerability in Gitea, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.6/10. Published 2026-08-05.

How severe is CVE-2026-34966?

High severity. CVSS v3 base score is 7.6 out of 10.

SSRF in Gitea

CVE-2026-34966

Gitea prior to 1.27.0 contains a server-side request forgery vulnerability that allows authenticated attackers to bypass SSRF protections by exploiting HTTP fetch operations in migration and OAuth avatar code paths that use Go's default ht…

Vulnerability class: SSRF (Server-Side Request Forgery)

CVSS v3 metric

CVSS v3 base score 7.6 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N.

Affected products

Gitea — versions 0, 1.27.0

Weakness classification (CWE)

CWE-918 — Server-Side Request Forgery (SSRF)

References

disclosure@vulncheck.com (product)
disclosure@vulncheck.com (vendor-advisory)
disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-34966?: CVE-2026-34966 is a high-severity vulnerability in Gitea, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.6/10. Published 2026-08-05.
How severe is CVE-2026-34966?: High severity. CVSS v3 base score is 7.6 out of 10.