CVE-2026-82556: Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery
A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply a patch to fix this issue. The project maintainer explains: "I don't intend to backport this to v15 or v16 as it is a breaking change."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Forgejo Repository Migration Handlerto a version that resolves this vulnerability.Patch b313bb83f5ff22bcc0378e0e0ca7bbd58303f168
Event History
Frequently Asked Questions
Who can exploit this issue?
The attack can be initiated remotely and requires low privileges. It affects the Repository Migration Handler, so exposure is tied to deployments where repository migration functionality is available to such users.
Which Forgejo versions should be considered affected?
Forgejo versions up to and including 15.0.4 are reported as affected. The available information does not state whether later versions are affected or fixed.
What should teams do if they are running an affected release?
Apply the patch identified as b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. The maintainer states that this change will not be backported to v15 or v16 because it is a breaking change.
How can I determine whether my deployment is exposed?
Confirm the Forgejo version and whether the Repository Migration Handler is enabled or available to low-privileged users. Deployments running 15.0.4 or earlier should be treated as affected based on the reported version range.