Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting
A critical authentication bypass vulnerability has been demonstrated in Gitea, allowing attackers to impersonate administrators and access private repositories simply by sending one HTTP header. The flaw, assigned CVE-2026-20896 and rated 9.8 on the CVSS scale, stems from a dangerous default in the official Docker image that trusts the X-WEBAUTH-USER header from any IP address.
Root Cause and Attack Flow
Gitea supports authentication via a reverse proxy for single sign-on scenarios. When enabled, the proxy authenticates the user and passes the username in the X-WEBAUTH-USER header. The application trusts this header only from addresses listed in the REVERSE_PROXY_TRUSTED_PROXIES configuration option. In the official Docker image the default value was set to a wildcard (“*”), meaning any source could supply the header.
An attacker could therefore send a request such as:
curl -H 'X-WEBAUTH-USER: admin' http://target:3000/admin/secret-infra/raw/branch/main/.env
and immediately retrieve the contents of a private repository file containing production secrets.
Additional Related Vulnerabilities
The same pattern of broken access control appeared in several other Gitea components throughout 2026:
- CVE-2026-27771 – private container images were served anonymously through the built-in OCI registry.
- CVE-2026-22874 – an overly permissive allow-list allowed SSRF via webhooks and migrations.
- CVE-2026-28740 – authorization bypass in LFS permitted reading objects from private repositories without proper rights.
These issues affected both Gitea and its fork Forgejo, impacting tens of thousands of internet-facing instances.
Recommended Mitigations
Administrators are advised to:
- Upgrade to Gitea 1.26.4 or newer (avoid 1.26.3 due to a regression in the SSRF fix).
- Explicitly configure REVERSE_PROXY_TRUSTED_PROXIES to the IP or CIDR of the actual reverse proxy.
- Disable reverse-proxy authentication if it is not required.
- Place Gitea behind a reverse proxy or WAF and monitor logs for 200 responses to administrative paths from unexpected source IPs.
The researcher emphasizes that the incident is not an isolated coding error but a systemic problem caused by overly permissive defaults in official container images.
Related articles
Critical Vulnerability in JetBrains TeamCity Allows Unauthenticated Remote Code Execution
JetBrains has disclosed a critical vulnerability in its on-premises TeamCity CI/CD server that permits remote attackers to execute arbitrary operating system commands without authentication. The flaw, tracked as CVE-2026-63077, affects the agent polling protocol and can be exploited simply by accessing the TeamCity Server over HTTP or HTTPS. With a CVSSv3.1 base score of 9.8, the issue is rated Critical and could lead to data theft, configuration changes, or compromise of build artifacts and downstream pipelines. No in-the-wild exploitation had been observed at the time of disclosure. JetBrains has released fixed versions TeamCity 2026.1.3 and 2025.11.7, along with a patch plugin for all releases since 2017.1, and recommends restricting external access until updates can be applied.
Critical OS Command Injection Flaw in Arista VeloCloud Orchestrator Exploited in the Wild
Arista Networks has disclosed a critical vulnerability in the on-premises version of its VeloCloud Orchestrator product used for centralized SD-WAN management. The flaw, tracked as CVE-2026-16812, is an OS command injection issue that allows remote attackers to compromise the system without any authentication. Exploitation has already been confirmed, and the vulnerability carries the maximum CVSS base score of 10.0 in both version 4.0 and 3.1, classifying it as Critical. Successful attacks can impact the confidentiality, integrity, and availability of the orchestrator and all managed data. In addition, a compromised VeloCloud Orchestrator instance may grant attackers access to connected VeloCloud Edge devices across the network.
CISA Adds Exploited Flaws in FortiOS and VeloCloud Orchestrator to Known Exploited Vulnerabilities Catalog
The US Cybersecurity and Infrastructure Security Agency has added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog. CVE-2026-16812 affects the on-premises version of Arista VeloCloud Orchestrator and allows OS command injection that can lead to data leakage, tampering, and denial of service. The flaw carries a maximum CVSS v3.1 base score of 10.0 and is rated Critical. CVE-2025-68686 impacts Fortinet FortiOS and can be used to bypass specific patches and steal sensitive information when combined with another vulnerability that grants prior filesystem access. Federal agencies must remediate the VeloCloud issue by July 30 and the FortiOS issue by August 10.
Critical Vulnerabilities in JetBrains IntelliJ IDEA and TeamCity Enable Remote Code Execution
JetBrains has addressed multiple critical vulnerabilities in its IntelliJ IDEA and TeamCity products that could allow remote code execution, unauthorized file access, and sandbox escapes. The flaws affect remote development environments and require immediate patching, especially in shared setups. In IntelliJ IDEA, CVE-2026-59792 involves directory traversal during workspace identifier processing and carries a CVSS score of up to 9.8. TeamCity received fixes for several issues, including malicious Git repository configurations that enable code execution and a Kotlin DSL sandbox escape. Additional patches cover arbitrary file access through Perforce integration and a persistent cross-site scripting flaw on cloud profile pages. Administrators are urged to update IntelliJ IDEA to versions 2026.1.4 or 2026.2 and TeamCity to 2026.1.2 or 2025.11.6 depending on the release line in use.