Gitea Docker image ships REVERSE_PROXY_TRUSTED_PROXIES=* allowing header-based user impersonation (CVE-2026-20896)
Government CERTs (Singapore CSA and the Canadian Centre for Cyber Security) report this trivially exploitable impersonation flaw is being exploited against internet-reachable Gitea Docker instances, so operators running reverse-proxy auth who do not patch today face unauthenticated admin takeover.
The official Gitea Docker images hard-code REVERSE_PROXY_TRUSTED_PROXIES = * in their app.ini templates instead of the documented loopback-only default. When an admin enables reverse-proxy authentication, any source IP that can reach the container can set X-WEBAUTH-USER to log in as any existing user, including administrators, with no password or cookie.
Affected: Gitea Docker images <= 1.26.2 (docker/root and docker/rootless app.ini templates); fixed in 1.26.3 / 1.26.4
How to Test
Check the running Gitea version (admin panel or `gitea --version`) and whether the image is <= 1.26.2; inspect the container app.ini (docker/root/etc/templates/app.ini:55 or rootless:52) for REVERSE_PROXY_TRUSTED_PROXIES = * and whether ENABLE_REVERSE_PROXY_AUTHENTICATION is true; test with `curl -s -L -H "X-WEBAUTH-USER: <existing_user>" http://host:3000/` and see if you are logged in as that user.
How to Patch
Upgrade to Gitea 1.26.3/1.26.4 (or 1.27.1), which removes REVERSE_PROXY_LIMIT/REVERSE_PROXY_TRUSTED_PROXIES from the Docker templates; as a stop-gap, set REVERSE_PROXY_TRUSTED_PROXIES to your proxy's address (e.g. 127.0.0.0/8,::1/128) or disable ENABLE_REVERSE_PROXY_AUTHENTICATION.