CVE-2026-82556
Received Received - Intake

Forgejo Repository Migration SSRF via net.LookupIP

Publication date: 2026-08-30

Last updated on: 2026-08-30

Assigner: VulDB

Description
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply a patch to fix this issue. The project maintainer explains: "I don't intend to backport this to v15 or v16 as it is a breaking change."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-30
Last Modified
2026-08-30
Generated
2026-08-30
AI Q&A
2026-08-30
EPSS Evaluated
N/A
NVD
CVE-2026-82556
EUVD
EUVD-2026-68278

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
forgejo forgejo to 15.0.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a server-side request forgery (SSRF) in Forgejo versions up to 15.0.4. It affects the net.LookupIP function in the Repository Migration Handler component. An attacker can remotely initiate requests that Forgejo will make, potentially accessing internal systems.

Detection Guidance

This vulnerability is specific to Forgejo versions up to 15.0.4 and involves server-side request forgery in the Repository Migration Handler. Detection requires checking the Forgejo version installed on your system. Use commands like 'forgejo --version' or check package managers (e.g., 'apt list --installed | grep forgejo'). Inspect logs for unusual network requests or migration attempts.

Impact Analysis

An attacker could exploit this to make Forgejo send requests to internal services, bypassing network restrictions. This may lead to unauthorized access to sensitive data or internal systems. The public exploit increases risk of real-world attacks.

Compliance Impact

SSRF vulnerabilities can lead to unauthorized data exposure, violating GDPR (data protection) and HIPAA (health data privacy). Compliance requires patching to prevent breaches that could result in regulatory fines or legal consequences.

Mitigation Strategies

Upgrade Forgejo to a version beyond 15.0.4. The patch commit b313bb83f5ff22bcc0378e0e0ca7bbd58303f168 addresses this issue. If upgrading is not feasible, consider disabling the Repository Migration Handler or restricting network access to the Forgejo instance until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-82556. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart