Forgejo

Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting

A critical authentication bypass vulnerability in Gitea, tracked as CVE-2026-20896 with a CVSS score of 9.8, allows attackers to gain administrative access and read private repositories by sending a single HTTP header. The root cause lies in the official Docker image defaulting the REVERSE_PROXY_TRUSTED_PROXIES setting to a wildcard, trusting the X-WEBAUTH-USER header from any source when reverse-proxy authentication is enabled. The researcher reproduced the full attack on a live vulnerable instance, demonstrating how an unauthenticated request could retrieve secret files such as .env containing database passwords and cloud keys. Multiple related access-control flaws were also disclosed in the same year, including CVE-2026-27771 affecting the container registry, CVE-2026-22874 in webhooks, and CVE-2026-28740 in LFS handling. The recommended fix involves explicitly setting trusted proxy IPs or disabling reverse-proxy authentication entirely and upgrading to version 1.26.4 or later. The issue highlights recurring problems with overly permissive defaults in self-hosted DevOps tools.