CVE-2026-20896

—

CVSS 3.1

9.8 critical

EPSS

3%p85

Published

Jul 3, 2026 (Jul 3, 2026)

Modified

Jul 7, 2026

Description

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Weakness: CWE-284
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.8%)

In the news3 stories

Critical Gitea Flaw Let Unauthenticated Attackers Read Server Files via Org

The Hacker NewsAug 5, 11:04 UTC · Aug 5, 2026Exploit / PoC in the wildCVE-2026-59774 CVE-2026-60004 CVE-2026-20896+1 CVEs

Threat Actors Probe Gitea Docker Flaw CVE-2026

The Hacker NewsJul 9, 06:04 UTC · Jul 9, 2026Threat actor in the wildCVE-2026-208961

Critical Gitea Docker Bug Under Active Exploitation Exposes Repositories and Secrets

Security AffairsJul 7, 21:16 UTC · Jul 7, 2026Vulnerability in the wildCVE-2026-208961