Rz1027

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.40.0 **Description** Authenticated users with table read permissions can retrieve datasource configurations through the read API to obtain live backend database credentials and service account keys. The system fails to redact credentials stored in STRING typed fields, which allows the exposure of MongoDB connection strings and Firebase private keys in plaintext. **Recommendations** Update to version 3.40.0 or later.

**Name of the Vulnerable Software and Affected Versions** Gitea Docker image versions prior to 1.26.3 **Description** A configuration flaw in the official Docker images allows an unauthenticated remote attacker to impersonate any user, including administrators, by spoofing the `X-WEBAUTH-USER` header. This occurs because the `app.ini` template hard-codes the `REVERSE PROXY TRUSTED PROXIES` variable to a wildcard (`*`), instructing the application to trust identity headers from any source IP address rather than restricting them to a trusted reverse proxy. This issue is exploitable when reverse-proxy authentication is enabled. If auto-registration is also active, an attacker can impersonate arbitrary usernames that do not yet exist in the system. Approximately 22,900 unique hosts running Gitea were identified as externally accessible, with a significant portion potentially affected. Real-world reconnaissance and exploitation attempts were observed shortly after public disclosure. The flaw affects the web interface but does not impact the token-based API endpoints (e.g., `/api/v1/...`). **Recommendations** Update Gitea to version 1.26.4 or newer. Replace the `REVERSE PROXY TRUSTED PROXIES = *` configuration with specific IP addresses of trusted reverse proxies. Disable the `ENABLE REVERSE PROXY AUTHENTICATION` setting if reverse-proxy authentication is not required. Disable user auto-registration if it is not necessary. Restrict direct access to the Gitea HTTP port using firewalls or network isolation to ensure traffic only flows through the intended reverse proxy.