CVE-2021-45325: Gitea SSRF Vulnerability
Summary
CVE-2021-45325: Gitea displaying raw OpenID error in UI. Affects github.com/go-gitea/gitea versions < 1.7.0. Fixed in 1.7.0. How to fix ↓
Also tracked for
- gitea · Bitnami
The same CVE-2021-45325 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gitea is a self-hosted Git service that allows users to set up their own Git server. It is written in Go and provides various features for managing repositories, users, and organizations. The vulnerability in question is a Server Side Request Forgery (SSRF) vulnerability that exists in Gitea versions prior to 1.7.0. This vulnerability specifically affects the OpenID URL functionality in Gitea, which can lead to the leakage of sensitive information about the local network through the error provided by the user interface (UI).
Vulnerability Detail
The SSRF vulnerability in Gitea allows an attacker to manipulate the OpenID URL and make requests to internal network resources. By exploiting this vulnerability, an attacker can potentially access sensitive information or perform actions on behalf of the Gitea server. The vulnerability is considered moderate in severity with a CVSS score of 5.3. It is classified under CWE-918.
How To Fix
Latest published version: v1.8.3 as of 23 Oct 2026
go get github.com/go-gitea/gitea@v1.8.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.0
This is the first release that contains the fix.
go get github.com/go-gitea/gitea@v1.7.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to upgrade to the fixed version as soon as possible.
Conclusion
In conclusion, the Gitea SSRF vulnerability (CVE-2021-45325) poses a moderate risk to Gitea instances prior to version 1.7.0. Upgrading to the fixed version is the recommended solution to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/go-gitea/gitea →
FAQ
Gitea is a self-hosted Git service that allows users to set up their own Git server. It provides features for managing repositories, users, and organizations.
Server Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests to internal network resources from the vulnerable server.
This vulnerability in Gitea can lead to the leakage of sensitive information about the local network through the error provided by the UI. An attacker could potentially access this information or perform actions on behalf of the Gitea server.
The CVSS score of this vulnerability is 5.3, which is considered moderate in severity.
To fix this vulnerability, it is recommended to upgrade Gitea to version 1.7.0 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/go-gitea/gitea.
