Somewhere, a developer set up a self-hosted Git server, felt very in-control of their infrastructure, and never checked the default config. That's the setup for a joke, except the punchline is "attackers can become your admin by typing one line into a request," and it's not funny if it's your repo.
Just Send a Header, Become the Admin
The vulnerability, CVE-2026-20896, carries a CVSS score of 9.8 and lives in Gitea's official Docker images from before version 1.26.3. The images shipped with an app.ini template hard-coding REVERSE_PROXY_TRUSTED_PROXIES = *, meaning the server trusted a reverse-proxy authentication header from literally any source IP address instead of only its actual proxy.
The practical result: anyone who can reach the exposed port can send a request with the header X-WEBAUTH-USER: admin and get treated as a fully authenticated administrator — no password, no token, no second factor, nothing. Security researchers confirmed active exploitation began roughly 13 days after the flaw's public disclosure, with Sysdig sensors catching the first real-world probe traced to a ProtonVPN exit node.
Your Side Project's Secrets Are Someone Else's Payday
This is the kind of bug that turns a hobby Git server into a genuine liability. An attacker walking in as admin gets read-and-write access to every repository, private ones included — meaning your source code, your CI/CD configuration, your deploy keys, and any API keys or database credentials some past version of you accidentally committed and forgot about.
The uncomfortable lesson here isn't really about Gitea's code — it's about default configurations shipped for convenience quietly becoming the biggest attack surface in the stack. "It worked out of the box" is a great pitch for a Docker image and a terrible security posture, and thirteen days was apparently all it took for someone to notice.
If you're running Gitea in Docker and haven't checked your version number today, today's the day. Upgrade to 1.26.3 or later before someone else logs in as you.
Source: The Hacker News