{"id":"EUVD-2026-41614","enisaUuid":"e9567633-a88b-3a88-8ce1-694987429b5d","description":"Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES\u003d* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.","datePublished":"Jul 3, 2026, 8:19:29 PM","dateUpdated":"Jul 7, 2026, 5:00:46 PM","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","aliases":"CVE-2026-20896\nGHSA-f75j-4cw6-rmx4\n","assigner":"Gitea","epss":2.76,"enisaIdProduct":[{"id":"a2ac9505-d06c-3839-8022-b6844b10c12b","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"enisaIdVendor":[{"id":"900a9b79-45fc-313d-9f95-adc510f2b238","vendor":{"name":"Gitea"}}],"enisaIdVulnerability":[{"id":"3d0fbf69-16d7-3ce4-b4bf-8e777fdc329c","vulnerability":{"id":"GHSA-f75j-4cw6-rmx4","description":"Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES \u003d *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`","datePublished":"Jul 21, 2026, 8:28:58 PM","dateUpdated":"Jul 21, 2026, 8:28:58 PM","baseScore":0.0,"references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-20896\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4\nhttps://github.com/go-gitea/gitea\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\n","enisa_id":"EUVD-2026-41614\n","aliases":"CVE-2026-20896\nGHSA-f75j-4cw6-rmx4\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:03:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"63b2568c-e308-3114-b198-e33c313302f2","vulnerability":{"id":"CVE-2026-20896","description":"Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES\u003d* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.","datePublished":"Jul 3, 2026, 8:19:29 PM","dateUpdated":"Jul 7, 2026, 5:00:46 PM","status":"PUBLISHED","baseScore":9.8,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","references":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4\nhttps://github.com/go-gitea/gitea/pull/38151\nhttps://github.com/go-gitea/gitea/releases/tag/v1.26.3\nhttps://blog.gitea.com/release-of-1.26.3-and-1.26.4/\n","enisa_id":"EUVD-2026-41614\n","assigner":"Gitea","epss":2.76,"dataProcessed":"Nov 4, 2026, 7:18:36 AM","vulnerabilityProduct":[{"id":"012e2085-de21-32e3-9fa6-3e6961d47a16","product":{"name":"Gitea Open Source Git Server","vendor":{"name":"Gitea"}},"product_version":"0 ≤1.26.2"}],"vulnerabilityVendor":[{"id":"e869a109-735e-3443-a93d-554e45bd2888","vendor":{"name":"Gitea"}}]}}],"enisaIdAdvisory":[]}