CVE-2026-82556: Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery | LiveThreat CVE Feed — Verisq

Login Request a demo

Medium severity · published Aug 30, 2026

CVE-2026-82556

Forgejo Repository Migration is_migrate_allowed.go net.LookupIP server-side request forgery

6.3

CVSS

0.4%

EPSS

No

On KEV

Description

A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/is_migrate_allowed.go of the component Repository Migration Handler. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit has been made public and could be used. The patch is named b313bb83f5ff22bcc0378e0e0ca7bbd58303f168. It is recommended to apply a patch to fix this issue. The project maintainer explains: "I don't intend to backport this to v15 or v16 as it is a breaking change."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

Low

Integrity

Low

Availability

Low

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.4% · higher than 30% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FO

Forgejo · Forgejo

15.0.0; 15.0.1; 15.0.2; 15.0.3; 15.0.4 · source: vendor

Affected product

FO

Forgejo

Forgejo

All Forgejo CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2026-82556

https://www.cve.org/CVERecord?id=CVE-2026-82556

https://codeberg.org/forgejo/forgejo/commit/b313bb83f5ff22bcc0378e0e0ca7bbd58303f168

https://codeberg.org/forgejo/forgejo/issues/13433

https://codeberg.org/forgejo/forgejo/pulls/13490

https://vuldb.com/cve/CVE-2026-82556

https://vuldb.com/submit/891889

https://vuldb.com/vuln/397072

More from Forgejo

9.9

Forgejo before 16.0.4 allows remote code execution via a crafted template repository because template expansion on files in .forgejo/template is mishandled

9.5

Forgejo before 13.0.2 allows attackers to write to unintended files, and possibly obtain server shell access, because of mishandling of out-of-repository symlink destinations for…

9.1

In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked

7.5

Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication

5.4

Forgejo < 15.0.3 - Stored XSS via Actions Run Full Name Rendering