Vulnerability · Published Jul 3, 2026 · Assigned by Gitea

CVE-2026-20896Gitea Docker image trusts spoofable reverse-proxy headers by default

Critical 9.8

In plain English

A critical-severity improper access control in Gitea Open Source Git Server from Gitea. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 86% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)2.8%top 13.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack tooling2Nuclei, Public PoC

Official description

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	code.gitea.io/gitea	1.26.3	GHSA-f75j-4cw6-rmx4
Go	code.gitea.io/gitea	1.26.3	GO-2026-6051

Affected products (as reported)

Vendor	Product	Versions
Gitea	Gitea Open Source Git Server	0 – through 1.26.2

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GitHub Security Advisory vendor-advisory
GitHub Pull Request #38151 patch
Gitea v1.26.3 Release release-notes
Gitea v1.26.4 Release Blog Post release-notes