CVE-2026-20896

Name of the Vulnerable Software and Affected Versions Gitea Docker image versions prior to 1.26.3

Description A critical authentication bypass exists in the official Gitea Docker image due to an insecure default configuration in the app.ini file. The variable REVERSE PROXY TRUSTED PROXIES is set to * by default, which instructs the application to trust identity headers from any source IP address. When reverse-proxy authentication is enabled (via ENABLE REVERSE PROXY AUTHENTICATION = true), an unauthenticated remote attacker can impersonate any user, including administrators, by spoofing the X-WEBAUTH-USER HTTP header. If auto-registration is enabled, the attacker can impersonate arbitrary usernames that do not yet exist in the system. This issue allows full access to repositories, CI/CD secrets, SSH keys, and administrative functions. It is noted that this flaw affects web sessions but does not impact the token-based API (/api/v1/...). Approximately 6,200 internet-exposed instances were identified as potentially vulnerable, and probing activity was observed in the wild shortly after disclosure.

Recommendations Update Gitea to version 1.26.4 or newer to resolve the issue and avoid a regression present in version 1.26.3. Set the REVERSE PROXY TRUSTED PROXIES variable to the specific IP addresses of trusted reverse proxies instead of using a wildcard. Disable the ENABLE REVERSE PROXY AUTHENTICATION setting if reverse-proxy authentication is not required. Disable user auto-registration if it is not necessary for the environment. Restrict direct access to the Gitea container's HTTP port using a firewall or network isolation to ensure traffic only flows through the intended reverse proxy.