CVE-2026-20896

Gitea can be set up so a reverse proxy (like a web gateway) “logs users in” by passing a special header that says who the user is. The problem is that, in the vulnerable Docker default, Gitea trusts those header values even if the request didn’t actually come through your reverse proxy. It’s like leaving a sign-in passcode door unlocked: someone can walk up and claim to be any user they want just by changing the header they send.

This matters to you if you run Gitea Open Source Git Server using the Docker image and you’ve enabled reverse-proxy authentication headers (for example, X-WEBAUTH-USER). It’s an internet-reachable risk because the vulnerable default trusts all proxy addresses, so any remote attacker can spoof the user identity. The reachability gate is: only a risk if reverse-proxy authentication headers are enabled AND the setup trusts all proxies by default (REVERSE_PROXY_TRUSTED_PROXIES=*).

This is RED because attackers have been reported probing for this exact weakness soon after disclosure, and the flaw enables impersonation without any login. If your configuration matches the vulnerable default (trusting all proxies) and reverse-proxy login headers are enabled, you should treat it as an emergency fix. Do not wait for a perfect moment—make configuration safe and upgrade as soon as you can.