CVE-2026-20896 is a critical security flaw in Gitea's official Docker images prior to version 1.26.3. The vulnerability arises because the default configuration allows connections from any IP address without proper allowlist enforcement when reverse-proxy authentication is enabled. Attackers can bypass authentication by sending a single HTTP header containing a valid username, gaining unauthorized access to the Gitea instance. This enables them to impersonate any user, including administrators, and access or modify private repositories and secrets. The flaw was publicly disclosed and exploited within 13 days, with monitoring tools detecting scanning activity targeting vulnerable instances. The issue was discovered by security researcher Ali Mustafa and reported by Sysdig. Gitea addressed the vulnerability by making reverse-proxy authentication opt-in starting with versions 1.26.3 and 1.26.4.

Successful exploitation allows attackers to bypass authentication without a password or token, impersonate any user with a known or guessable username, and gain full read/write access to private repositories, including sensitive secrets such as API keys, database credentials, and deployment tokens. This can lead to complete compromise of the codebase and confidential information stored in affected Gitea instances. The vulnerability is actively exploited in the wild, increasing the risk to exposed deployments.

A patch addressing this vulnerability is available in Gitea versions 1.26.3 and 1.26.4, which make reverse-proxy authentication an opt-in feature and enforce proper allowlist settings. Users should update their Gitea deployments to these versions or later as soon as possible to mitigate the risk. Until patched, ensure that Gitea instances are not directly accessible without the intended authenticating proxy and restrict network access to trusted sources only.