/Vulnerability Library

Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass

CVE-2026-20896
Verified

Description

The official Gitea Docker image through version 1.26.2 ships with REVERSE_PROXY_TRUSTED_PROXIES set to a wildcard, causing Gitea to trust reverse-proxy authentication headers (X-WEBAUTH-USER) from any source IP instead of restricting trust to the configured reverse proxy. When reverse-proxy authentication is enabled, an unauthenticated remote attacker can impersonate any existing user, including an administrator, by sending the target username in the X-WEBAUTH-USER header.

Severity

Critical

CVSS Score

9.8

Exploit Probability

3%

Affected Product

gitea

Published Date

August 3, 2026

Template Author

prithvee07, aryu-ru, rz1027

CVE-2026-20896.yaml
9.8Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-20896
CWE ID:
cwe-290

References

https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4https://blog.gitea.com/release-of-1.26.3-and-1.26.4/https://github.com/go-gitea/gitea/pull/38151https://www.ionix.io/threat-center/cve-2026-20896/https://nvd.nist.gov/vuln/detail/CVE-2026-20896

Remediation Steps

Upgrade the Gitea Docker image to version 1.26.3 or 1.26.4 or later, which restricts REVERSE_PROXY_TRUSTED_PROXIES to the intended internal proxy addresses.