Gitea Docker Image Default Trusted Proxy Misconfiguration

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: Gitea Limited

Description

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-20896

Affected Vendors & Products

Vendor	Product	Version / Range
gitea	gitea	to 1.26.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability exists in Gitea Docker image versions up to and including 1.26.2. By default, these versions set the configuration REVERSE_PROXY_TRUSTED_PROXIES to '*', which means any source IP address is trusted. When reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled, this allows an attacker to impersonate any user by sending requests with forged headers.

Impact Analysis

This vulnerability can have severe impacts because it allows an attacker to impersonate any user without authentication. This can lead to unauthorized access to sensitive information, modification or deletion of data, and full compromise of the application. The CVSS score of 9.8 indicates a critical severity with high impact on confidentiality, integrity, and availability.

Hi! I’m here to help you understand CVE-2026-20896. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70