Vulnerability details

CVE-2026-20896

Gitea Open Source Git Server

Gitea Docker image trusts spoofable reverse-proxy headers by default

CVSS 3.1

9.8Critical

Official description

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

CVSS scores

Score	Version	Source	Vector
9.8Critical	3.1	CVEProject cvelistV5 (CNA) (Gitea)	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`

Affected products

Vendor	Product	Versions	Source
Gitea	Gitea Open Source Git Server	v ≤ 1.26.2	CVEProject cvelistV5 (CNA)

References and advisories

https://github.com/go-gitea/gitea/pull/38151 patch
https://github.com/go-gitea/gitea/releases/tag/v1.26.3 release-notes
https://blog.gitea.com/release-of-1.26.3-and-1.26.4/ release-notes
https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4 vendor-advisory

Kolun on Telegram @kolunsec Exploited CVEs, key news and a daily digest Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.

Details

Published: 2026-07-03
Last updated: 2026-07-07
State: Published
Assigner (CNA): Gitea

Exploit prediction (EPSS)

2.75%

Probability of exploitation in 30 days

86.2%

Percentile (among all CVEs)

SSVC assessment (CISA)

Automatable: Yes
Exploitation: Proof of concept
Technical impact: Total

Weaknesses (CWE)

CWE-284