Gitea Authentication Bypass Exposes Private Repositories Through Default Docker Reverse Proxy Setting
A critical authentication bypass vulnerability has been demonstrated in Gitea, allowing attackers to impersonate administrators and access private repositories simply by sending one HTTP header. The flaw, assigned CVE-2026-20896 and rated 9.8 on the CVSS scale, stems from a dangerous default in the official Docker image that trusts the X-WEBAUTH-USER header from any IP address.
Root Cause and Attack Flow
Gitea supports authentication via a reverse proxy for single sign-on scenarios. When enabled, the proxy authenticates the user and passes the username in the X-WEBAUTH-USER header. The application trusts this header only from addresses listed in the REVERSE_PROXY_TRUSTED_PROXIES configuration option. In the official Docker image the default value was set to a wildcard (“*”), meaning any source could supply the header.
An attacker could therefore send a request such as:
curl -H 'X-WEBAUTH-USER: admin' http://target:3000/admin/secret-infra/raw/branch/main/.env
and immediately retrieve the contents of a private repository file containing production secrets.
Additional Related Vulnerabilities
The same pattern of broken access control appeared in several other Gitea components throughout 2026:
- CVE-2026-27771 – private container images were served anonymously through the built-in OCI registry.
- CVE-2026-22874 – an overly permissive allow-list allowed SSRF via webhooks and migrations.
- CVE-2026-28740 – authorization bypass in LFS permitted reading objects from private repositories without proper rights.
These issues affected both Gitea and its fork Forgejo, impacting tens of thousands of internet-facing instances.
Recommended Mitigations
Administrators are advised to:
- Upgrade to Gitea 1.26.4 or newer (avoid 1.26.3 due to a regression in the SSRF fix).
- Explicitly configure REVERSE_PROXY_TRUSTED_PROXIES to the IP or CIDR of the actual reverse proxy.
- Disable reverse-proxy authentication if it is not required.
- Place Gitea behind a reverse proxy or WAF and monitor logs for 200 responses to administrative paths from unexpected source IPs.
The researcher emphasizes that the incident is not an isolated coding error but a systemic problem caused by overly permissive defaults in official container images.
Related articles
Windows Lacks Official Patch for LegacyHive Zero-Day; 0Patch Delivers Free Micro-Patch
A zero-day vulnerability named LegacyHive has been discovered in the Windows user profile service, allowing any standard user to mount another user's registry hive with full access. The flaw was reported on July 14 by researcher Nightmare Eclipse, coinciding with Microsoft's Patch Tuesday, and enables extraction of stored secrets or persistence by modifying registry settings that execute code on the next administrator login. Microsoft has acknowledged the issue and is investigating, but no official fix has been released yet. ACROS Security stepped in with a free micro-patch through its 0Patch platform that neutralizes the exploit by redirecting it to a harmless temporary hive instead of the administrator profile. The protection is available for Windows 10 version 2004 and later, as well as Windows Server 2022 and newer releases, and requires only registration and agent installation without a reboot. Researchers Will Dormann and Kevin Beaumont have independently confirmed the exploit's functionality, with Beaumont also publishing Microsoft Defender for Endpoint queries to detect related attacks.
WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has issued version 7.0.2 along with other security releases on July 17, 2026, addressing two critical vulnerabilities identified as CVE-2026-63030 and CVE-2026-60137. When combined, these flaws enable remote attackers to execute arbitrary code on affected installations. CVE-2026-60137 stems from insufficient input validation in certain functions, potentially allowing SQL injection when processing untrusted data from plugins or themes. CVE-2026-63030 involves route interpretation confusion in the REST API batch endpoint, which can be leveraged alongside the SQL injection issue to achieve code execution. The vulnerabilities impact WordPress 6.8 and later branches, although chained attacks are not possible on the 6.8 series. Administrators are urged to apply the updates immediately to mitigate the risks.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
Google Issues Emergency Chrome Update Patching Seven Vulnerabilities Including Three Critical Flaws
Google has released a new security update for its Chrome browser addressing seven vulnerabilities just two days after the previous patch. The update covers Windows, macOS, and Linux platforms with versions Chrome 150.0.7871.129 and 150.0.7871.128. Three of the issues, tracked as CVE-2026-15899, CVE-2026-15900, and CVE-2026-15901, received the highest severity rating of Critical and involve Use After Free flaws in CameraCapture, GPU, and Network components. Four additional High-severity vulnerabilities were also fixed, including an out-of-bounds access issue in the V8 JavaScript engine and Use After Free problems in Cast, Ozone, and Aura. The company plans to roll out the patches gradually over the coming days and weeks to all users.