Gitea · Gitea Open Source Git Server
The Gitea Open Source Git Server, as shipped in its Docker image, trusts reverse-proxy authentication headers from any source IP by default because REVERSE_PROXY_TRUSTED_PROXIES is set to *, which is an improper access control flaw. An attacker who can reach the instance directly over the network can impersonate any user by sending a spoofed X-WEBAUTH-USER header, provided reverse-proxy authentication is enabled in the configuration.
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
First seen exploited 3 days after disclosure. Public exploit code (PoC-in-GitHub) was available 1 day before disclosure.
No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
1 package in 1 ecosystem. Main package: code.gitea.io/gitea.
Upgrade to 1.26.3
Fixes this CVE and 2 other known vulnerabilities in this package (CVE-2020-14144, CVE-2022-30781).
Still affected on this line by CVE-2026-60004 (no fix published).
go get code.gitea.io/gitea@v1.26.3The first fix for CVE-2026-20896.
| If you run | Upgrade to |
|---|---|
| All versions before 1.26.3 | 1.26.3 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.