Gitea's official Docker image configured reverse-proxy authentication to trust identity headers from any client IP address rather than only from trusted reverse proxies, allowing unauthenticated attackers to impersonate arbitrary users. The maintainer shared the steps to reproduce it, warning that 'any process that can reach the Gitea container's HTTP port directly - not through the intended authenticating proxy - can impersonate any user whose login name is known or guessable. Admin accounts (admin, gitea_admin, etc.) are the obvious targets.'
| Vendor | Product | Versions |
|---|---|---|
| gitea | gitea | go/code.gitea.io/gitea: < 1.26.3 |
Updated description with detailed exploitation steps, added new CWE ID, and included patch version 1.26.4.
Added affected versions 1.26.3 and 1.26.4, and updated patch information to reflect the new versions.
Updated exploit availability to true and marked the vulnerability as actively exploited.
Initial creation
