CVE-2026-20896

CVE Enrichment

CVSS: 9.8 CRITICAL
EPSS: 2.76%
EPSS Percentile: 86.19%
CISA KEV: Not listed

Description

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 88ee5874-cf24-4952-aea0-31affedb7ff2
Published: 04-Jul-2026 04:16
Last Modified: 25-Oct-2026 22:10
EPSS Date: 2026-10-28
CWE: CWE-284

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 29-Oct-2026 03:13
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

Hackers are actively exploiting CVE-2026-20896, a critical authentication bypass in Gitea’s official Docker image that can let attackers impersonate any user, including administrators. Hackers Exploit Gitea Docker Image Authentication Bypass
Specific to Gitea’s official Docker images, the critical-severity security defect is tracked as CVE-2026-20896 (CVSS score of 9.8) and can be exploited with a single HTTP header, Sysdig Sr. Gitea CVE-2026-20896 Exploited in the Wild, Researchers Warn
Threat actors are beginning to probe a critical Gitea Docker image flaw, CVE-2026-20896, which can let an unauthenticated attacker impersonate users by abusing the X-WEBAUTH-USER header. Gitea Docker Flaw CVE-2026-20896 Probed After Disclosure; Fix Available

People (2)

MITRE ATT&CK (1)

Vendors (2)

Products (1)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.