{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gitea/gitea-docker-images/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-20896"}],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":["https://sploitus.com/exploit?id=2E636F7C-D328-572A-AAAE-86B8C5A6D4B6\u0026utm_source=rss\u0026utm_medium=rss"],"_cs_products":["gitea/gitea Docker images","go/code.gitea.io/gitea"],"_cs_severities":["critical"],"_cs_tags":["misconfiguration","authentication-bypass","docker","gitea","web-application","cve"],"_cs_type":"advisory","_cs_vendors":["Gitea"],"content_html":"\u003cp\u003eGitea Docker images (versions prior to 1.26.3) contain a critical security misconfiguration, CVE-2026-20896, where the \u003ccode\u003eapp.ini\u003c/code\u003e template hard-codes \u003ccode\u003eREVERSE_PROXY_TRUSTED_PROXIES = *\u003c/code\u003e. This default deviates from the secure documented standard of \u003ccode\u003e127.0.0.0/8,::1/128\u003c/code\u003e (loopback only). When \u003ccode\u003eENABLE_REVERSE_PROXY_AUTHENTICATION\u003c/code\u003e is set to \u003ccode\u003etrue\u003c/code\u003e in a vulnerable Gitea Docker deployment, any process or attacker capable of directly reaching the Gitea container's HTTP port can impersonate any user. This is achieved by simply supplying an \u003ccode\u003eX-WEBAUTH-USER\u003c/code\u003e HTTP header with a known or guessable username, bypassing standard authentication mechanisms like passwords or session cookies. This vulnerability affects \u003ccode\u003egitea/gitea\u003c/code\u003e Docker images up to version 1.26.2 and poses a significant risk for unauthorized access.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003e\u003cstrong\u003eDeployment of Vulnerable Gitea Container\u003c/strong\u003e: An organization deploys a \u003ccode\u003egitea/gitea\u003c/code\u003e Docker image (version prior to 1.26.3) configured with \u003ccode\u003eENABLE_REVERSE_PROXY_AUTHENTICATION = true\u003c/code\u003e, retaining the image's default \u003ccode\u003eREVERSE_PROXY_TRUSTED_PROXIES = *\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eNetwork Exposure\u003c/strong\u003e: The Gitea container's HTTP port (e.g., 3000) is directly accessible to an attacker, potentially bypassing any intended authenticating reverse proxy.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUser Enumeration/Knowledge\u003c/strong\u003e: The attacker identifies or guesses valid usernames within the Gitea instance (e.g., 'admin', 'alice').\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eCrafting Malicious HTTP Request\u003c/strong\u003e: The attacker crafts an HTTP GET or POST request targeting the vulnerable Gitea instance, including the \u003ccode\u003eX-WEBAUTH-USER\u003c/code\u003e header set to an identified username.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAuthentication Bypass\u003c/strong\u003e: The misconfigured Gitea instance, treating all incoming connections as trusted proxies, accepts the \u003ccode\u003eX-WEBAUTH-USER\u003c/code\u003e header from the attacker's source IP as a legitimate authentication credential.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eAccount Impersonation\u003c/strong\u003e: The attacker's request is processed with the privileges of the user specified in the \u003ccode\u003eX-WEBAUTH-USER\u003c/code\u003e header, granting unauthorized access to that user's account.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eImpact\u003c/strong\u003e: The attacker gains full control over the impersonated user's Gitea account, allowing actions such as repository modification, unauthorized access to code, or privilege escalation if an administrative account was targeted, leading to full control of the Git hosting platform.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-20896 allows any process that can directly access the Gitea Docker container's HTTP port to completely bypass authentication and impersonate any existing user. This includes highly privileged accounts like administrators (e.g., 'admin', 'gitea_admin'), leading to full compromise of the Gitea instance. Attackers can gain unauthorized access to source code repositories, manipulate project data, create new users, delete existing content, or achieve complete control over the Git hosting platform. While specific victim counts are not available, all deployments using vulnerable Gitea Docker images with \u003ccode\u003eENABLE_REVERSE_PROXY_AUTHENTICATION\u003c/code\u003e enabled are at critical risk.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePatch CVE-2026-20896\u003c/strong\u003e by upgrading \u003ccode\u003egitea/gitea\u003c/code\u003e Docker images to version 1.26.3 or newer immediately to address the insecure default configuration.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eManually Configure Trusted Proxies\u003c/strong\u003e: If immediate upgrade is not feasible, modify the \u003ccode\u003eREVERSE_PROXY_TRUSTED_PROXIES\u003c/code\u003e setting in \u003ccode\u003eapp.ini\u003c/code\u003e to explicitly list only the IP addresses of trusted reverse proxies (e.g., \u003ccode\u003e127.0.0.0/8,::1/128\u003c/code\u003e) and restart the Gitea container.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eDeploy the Sigma rule\u003c/strong\u003e titled \u0026quot;Detect CVE-2026-20896 Exploitation - Gitea Impersonation via X-WEBAUTH-USER\u0026quot; to your SIEM and tune it for your environment.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eEnable comprehensive web server logging\u003c/strong\u003e to capture HTTP request headers and client IP addresses, which are critical log sources for detecting the exploitation behavior described.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-15T20:31:53Z","date_published":"2026-07-21T20:36:08Z","id":"https://feed.craftedsignal.io/briefs/2026-07-gitea-docker-impersonation/","summary":"Gitea Docker images ship with a critical misconfiguration, CVE-2026-20896, where `REVERSE_PROXY_TRUSTED_PROXIES = *` by default, enabling any client to bypass authentication and impersonate users via the `X-WEBAUTH-USER` HTTP header when reverse proxy authentication is enabled, leading to unauthorized access to user accounts, including administrative ones.","title":"Gitea Docker Images Insecure Default Allows User Impersonation via X-WEBAUTH-USER","url":"https://feed.craftedsignal.io/briefs/2026-07-gitea-docker-impersonation/"}],"language":"en","title":"CraftedSignal Threat Feed - Gitea/Gitea Docker Images","version":"https://jsonfeed.org/version/1.1"}