CVE-2026-89430

The Gitea push mirror functionality contains a Server-Side Request Forgery (SSRF) vulnerability (CWE-918) and a Time-of-check Time-of-use (TOCTOU) race condition (CWE-367). The software only validates a push mirror's remote address against [migrations] allow and block lists during creation. Durin...