Description
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Gitea | Gitea Open Source Git Server | ≤ 1.26.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 8 repositories
-
szybnev/cve-2026-20896-gitea-poc ★ 10 · Jul 7, 2026
CVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker
-
XaocZenon/CVE-2026-20896 ★ 6 · Jul 16, 2026
this is a modified POC of rz1027 for CVE-2026-20896
-
rz1027/CVE-2026-20896 ★ 6 · Jul 5, 2026
Public PoC and detector for CVE-2026-20896 ("Gitea Docker: One Header, Any User")
-
yym8538/CVE-2026-20896 ★ 1 · Aug 21, 2026
-
judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass ★ 1 · Aug 15, 2026
An explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.
-
EQSTLab/CVE-2026-20896 ★ 1 · Jul 29, 2026
Gitea Docker Image Authentication Bypass
-
kaleth4/CVE-2026-20896 ★ 1 · Jul 2, 2026
-
Raincombat/CVE-2026-20896-Gitea-CTF ★ 0 · Oct 15, 2026
CVE-2026-20896 Gitea Docker CTF Challenge
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Gitea Docker Image <= 1.26.2 - Reverse Proxy Header Authentication Bypass http/cves/2026/CVE-2026-20896.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | code.gitea.io/gitea | < 1.26.3 | 1.26.3 | GHSA-f75j-4cw6-rmx4 |
Advisories 2
- WID-SEC-2026-2027 Gitea: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 12, 2026
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
References
- GitHub Security Advisory vendor-advisory
- GitHub Pull Request #38151 patch
- Gitea v1.26.3 Release release-notes
- Gitea v1.26.4 Release Blog Post release-notes