CVE-2026-20896

Name of the Vulnerable Software and Affected Versions Gitea Docker image versions prior to 1.26.3

Description A configuration flaw in the official Docker images allows an unauthenticated remote attacker to impersonate any user, including administrators, by spoofing the X-WEBAUTH-USER header. This occurs because the app.ini template hard-codes the REVERSE PROXY TRUSTED PROXIES variable to a wildcard (*), causing the application to trust identity headers from any source IP address instead of only trusted loopback addresses. This issue is exploitable when reverse-proxy authentication is enabled. It is estimated that approximately 22,900 unique Gitea hosts are accessible from the internet, with 83% potentially affected. Real-world reconnaissance and exploitation attempts were detected within 13 days of public disclosure. The flaw allows access to repositories, CI/CD secrets, SSH keys, and administrative functions via the web interface, although the token-based API endpoints (e.g., /api/v1/...) are not affected.

Recommendations Update Gitea to version 1.26.4 or newer. As a temporary mitigation, disable the ENABLE REVERSE PROXY AUTHENTICATION setting if it is not required. Replace the wildcard value of the REVERSE PROXY TRUSTED PROXIES variable with specific IP addresses of trusted reverse proxies. Disable automatic user registration to prevent attackers from creating arbitrary accounts. Restrict direct network access to the Gitea container's HTTP port, ensuring traffic only flows through the intended reverse proxy.