Executive brief
Gitea is a popular self-hosted Git service. A security issue in its official Docker images allows anyone who can reach the server to log in as any user, including administrators, without a password. This could lead to a total takeover of the Git server, exposure of private source code, and disruption of development operations.
Technical details
The Gitea Docker images ship with a hard-coded configuration setting `REVERSE_PROXY_TRUSTED_PROXIES = *` in the `app.ini` template. When an administrator enables `ENABLE_REVERSE_PROXY_AUTHENTICATION`, Gitea is designed to trust identity information provided in HTTP headers (like `X-WEBAUTH-USER`) from a trusted proxy. Because the Docker image trusts all source IPs by default instead of just the loopback address, any network-reachable attacker can bypass authentication by sending a crafted HTTP header with a target username. This vulnerability affects Docker-based deployments of Gitea versions prior to 1.26.3. Users should upgrade to version 1.26.3 or manually restrict the `REVERSE_PROXY_TRUSTED_PROXIES` setting to specific trusted IP addresses.
Affected products
- Gitea Gitea Docker Image < 1.26.3
Timeline
- 2026-06-21: disclosed
- 2026-07-03: advisory: NVD publication date
- 2026-07-21: advisory: GitHub Advisory published