CVE-2026-20896
published 2026-07-03CVE-2026-20896: Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when…
PriorityP193critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
62.38%
99.1th percentile
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| code.gitea.io | gitea | >= 0 < 1.26.3 | 1.26.3 |
| gitea | gitea_open_source_git_server | <= 1.26.2 | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Alert on X-WEBAUTH-USER header values targeting known admin usernames such as 'admin' or 'gitea_admin', as these are the primary targets for privilege escalation via auto-registration. ↗
- →Monitor Gitea app.ini for the presence of REVERSE_PROXY_TRUSTED_PROXIES=* combined with ENABLE_REVERSE_PROXY_AUTHENTICATION=true, which together constitute the vulnerable configuration. ↗
- ·Exploitation requires ENABLE_REVERSE_PROXY_AUTHENTICATION to be explicitly set to true by an admin; instances where reverse-proxy authentication is not enabled are not directly exploitable via this header-injection path. ↗
- ·The safe/documented default for REVERSE_PROXY_TRUSTED_PROXIES is '127.0.0.0/8,::1/128' (localhost only), but the official Gitea Docker image hard-codes '*' instead, overriding this safe default for all Docker-based deployments up to and including 1.26.2. ↗
- ·Auto-registration being enabled amplifies impact: an attacker sending an admin username via X-WEBAUTH-USER will be automatically registered and granted admin privileges if the account does not yet exist. ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
ghsa·2026-07-21
CVE-2026-20896 [CRITICAL] CWE-284 Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
# Summary
The Gitea Docker images ship an `app.ini` template that hard-codes:
```
REVERSE_PROXY_TRUSTED_PROXIES = *
```
The documented default for this setting, in `custom/conf/app.example.ini`, is `127.0.0.0/8,::1/128`, i.e. only loopback is trusted.
When an admin enables `ENABLE_REVERSE_PROXY_AUTHENTICATION = true` to put Gitea behind an authenticating reverse proxy and leaves the trusted-proxies setting at "the default", they expect only the proxy's loopback connection to inject identity. The Docker image instead trusts `X-WEBAUTH-USER` from **any source IP** that can reach the container.
## Affected
- `gitea/gitea` Docker images (verified `1.26.2`)
- `dock
VulnCheck
Improper Access Control
vulncheck·2026·CVSS 9.8
CVE-2026-20896 [CRITICAL] Improper Access Control
Improper Access Control
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
Affected: Gitea Gitea Open Source Git Server
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.linkedin.com/feed/update/urn:li:activity:7479652557561454592/
Exploit PoC: https://vulncheck.com/xdb/0ede3f054e22
No detection rules found.
No public exploits indexed.
Hackernews
Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
blogs_hackernews·2026-08-05·CVSS 9.8
CVE-2026-59774 [CRITICAL] Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org-Mode Markup
An unauthenticated attacker can read any file the service account can access on Gitea , the self-hosted Git platform, in versions 1.22.1 through 1.27.0. No login, no repository write access. A public repository and crafted Org-mode markup are enough. The flaw is fixed in Gitea 1.27.1.
CVE-2026-59774
CVE-2026-60004
Gitea said Cloud instances would be upgraded automatically during the release maintenance window. Self-hosted administrators should move to 1.27.1 immediately.
app.ini
INTERNAL_TOKEN
That chain is described in Gitea's advis
Hackernews
⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
blogs_hackernews·2026-07-06
CVE-2026-48276 ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More
A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary.
Home devices became a routing cover. Clean code pulled dirt from a dependency. Identity shortcuts aged badly. AI systems trusted the wrong instructions. Same soft spot throughout: trust placed one layer too early.
Below is the full recap, since this is apparently what counted as a normal week.
## ⚡ Threat of the Week
Net
Hackernews
Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
blogs_hackernews·2026-07-06·CVSS 9.8
CVE-2026-20896 [CRITICAL] Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Threat Actors Probe Gitea Docker Flaw CVE-2026-20896 13 Days After Disclosure
Threat actors have been observed attempting to exploit a recently patched critical security flaw in Gitea Docker images, according to Sysdig .
The vulnerability in question is CVE-2026-20896 (CVSS score: 9.8), a vulnerability that stems from the DevOps platform trusting the "X-WEBAUTH-USER" header from any source IP address, effectively allowing an unauthenticated internet client to get elevated access.
In a statement shared with The Hacker News via email, security researcher Ali Mustafa (@rz1027), who is credited with discovering and reporting th
2026-07-03
Published
Exploited in the wild