CVE-2026-22874

Critical

Published: 03 July 2026

Published

03 July 2026

Modified

03 July 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.6 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

EPSS Score N/A

Risk Priority 70 floored blend · peak EPSS

Summary

CVE-2026-22874 is a critical-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 9.6 (Critical).

Operationally, it is not currently listed in the CISA KEV catalog.

Gitea versions up to and including 1.26.2 have incomplete SSRF protection in webhook and migration allow-list filtering.

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

—

Gitea

inferred from references and description; NVD did not file a CPE for this CVE

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-918

Penetration testing attempts server-side requests to internal resources, identifying SSRF weaknesses for remediation.

addresses: CWE-918

Outbound connections to external resources can be monitored and limited at the boundary, reducing SSRF impact.

addresses: CWE-918

Validates server-side URLs and resource references to block SSRF attempts.

addresses: CWE-918

Detects server-side request forgery through monitoring of unexpected outbound connections.