PT-2026-52216 · Gitea · Gitea
CVSS v2.0
10
Critical
| Vector | AV:N/AC:L/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Gitea Docker image versions prior to 1.26.3
Description
The official Gitea Docker image contains a configuration flaw in the
app.ini template where the REVERSE PROXY TRUSTED PROXIES variable is set to * by default. When reverse-proxy authentication is enabled via the ENABLE REVERSE PROXY AUTHENTICATION setting, the application trusts identity headers from any source IP address instead of restricting them to a trusted proxy. This allows an unauthenticated remote attacker to impersonate any user, including administrators, by sending a crafted X-WEBAUTH-USER header. If auto-registration is enabled, the attacker can impersonate arbitrary usernames that do not yet exist in the system. This issue is exploitable via the web interface but does not affect the token-based API. Approximately 22,900 unique hosts running Gitea were identified as externally accessible, with an estimated 6,200 instances being targeted in real-world reconnaissance and exploitation attempts. Successful exploitation can lead to full compromise of repositories, CI/CD secrets, SSH keys, and administrative access.Recommendations
Update Gitea Docker images to version 1.26.4 or newer.
Set the
REVERSE PROXY TRUSTED PROXIES variable to the specific IP addresses of trusted reverse proxies instead of using a wildcard.
Disable the ENABLE REVERSE PROXY AUTHENTICATION setting if reverse-proxy authentication is not required.
Disable user auto-registration if it is not necessary.
Restrict direct network access to the Gitea container port to ensure traffic only flows through the intended reverse proxy.Exploit
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gitea