The vulnerability in Gitea Open Source Git Server Docker images (<=1.26.2) arises from the default setting REVERSE_PROXY_TRUSTED_PROXIES=* which trusts all source IP addresses. When reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled, this configuration allows an attacker to spoof their IP address and impersonate any user. This is classified as CWE-284 (Improper Access Control) and has a CVSS 3.1 score of 9.8, indicating critical severity with network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability.

An attacker can impersonate any user by sending crafted requests with authentication headers from any source IP address. This compromises user authentication, potentially granting unauthorized access to sensitive repositories and administrative functions, leading to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid enabling reverse-proxy authentication headers or restrict the REVERSE_PROXY_TRUSTED_PROXIES setting to trusted IP addresses only to prevent unauthorized user impersonation.