CVE-2026-20896

Name of the Vulnerable Software and Affected Versions Gitea Docker image versions prior to 1.26.3

Description A configuration flaw in the official Docker images allows an unauthenticated remote attacker to impersonate any user, including administrators, by spoofing the X-WEBAUTH-USER header. This occurs because the app.ini template hard-codes the REVERSE PROXY TRUSTED PROXIES variable to a wildcard (*), instructing the application to trust identity headers from any source IP address rather than restricting them to a trusted reverse proxy. This issue is exploitable when reverse-proxy authentication is enabled. If auto-registration is also active, an attacker can impersonate arbitrary usernames that do not yet exist in the system. Approximately 22,900 unique hosts running Gitea were identified as externally accessible, with a significant portion potentially affected. Real-world reconnaissance and exploitation attempts were observed shortly after public disclosure. The flaw affects the web interface but does not impact the token-based API endpoints (e.g., /api/v1/...).

Recommendations Update Gitea to version 1.26.4 or newer. Replace the REVERSE PROXY TRUSTED PROXIES = * configuration with specific IP addresses of trusted reverse proxies. Disable the ENABLE REVERSE PROXY AUTHENTICATION setting if reverse-proxy authentication is not required. Disable user auto-registration if it is not necessary. Restrict direct access to the Gitea HTTP port using firewalls or network isolation to ensure traffic only flows through the intended reverse proxy.