CVE-2026-54481

CVE-2026-54481 affects Gitea: the internal API HTTP client hardcodes TLS InsecureSkipVerify = true with no configuration override. This enables potential MITM in split-host deployments, exposing the static INTERNAL_TOKEN used for internal endpoints. Exploitation details are described in the GHSA-...