CVE-2026-25119

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description When ENABLE REVERSE PROXY AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. A remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, resulting in a complete authentication bypass. This occurs within the authenticatedUser() function, which reads the header from the incoming HTTP request without verifying if the header was set by a trusted proxy or if the request actually passed through one.

Recommendations Update to version 0.14.3. As a temporary workaround, set ENABLE REVERSE PROXY AUTHENTICATION to false in the configuration.