What is CVE-2026-20896?
Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.
The record classifies CVE-2026-20896 under weakness class CWE-284. Its CVSS v3 base vector states that the flaw is reachable remotely over the network, needs no prior authentication, needs no user interaction, and has high impact on confidentiality, integrity, availability. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 121 days ago.
Severity and exploitation probability
- CVSS v3.1 base score
- 9.8 — CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS (FIRST)
- 0.7% probability of exploitation in the next 30 days, higher than 51.5% of all scored CVEs
- CISA KEV
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Threadlinqs priority
- 9/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
- Published
- 2026-07-03, last modified 2026-07-05
Is CVE-2026-20896 being exploited?
Weaponised exploit code for CVE-2026-20896 is publicly available. 2 public proof-of-concept repositories are tracked for this identifier. It currently carries a trending score of 55 in the Threadlinqs vulnerability feed.
- kaleth4/CVE-2026-20896 (github)
- rz1027/CVE-2026-20896 (github)
Affected products and versions
- Gitea: Open Source Git Server
How to fix CVE-2026-20896
No vendor patch reference has been recorded for CVE-2026-20896 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.
Threat activity tracking CVE-2026-20896
2 tracked threats in the Threadlinqs corpus reference CVE-2026-20896, either in the campaign’s CVE list or as an indicator on the campaign record.
- Exploitarium: Mass Public Disclosure of Unreported Zero-Day PoCs (libssh2 CVE-2026-55200, Gitea CVE-2026-20896 / CVE-2026-58053, 7-Zip, Docker, OpenVPN Connect, VLC, nmap) — HIGH · 2026-10-31
- Threat Actors Mass-Probe Gitea Docker Deployments for CVE-2026-20896 Authentication Bypass Amid Exploitarium Zero-Day Leak Wave — CRITICAL · 2026-07-06
Sources
Enriched from CVE.org, NVD, FIRST EPSS, public proof-of-concept repositories. Last verified by Threadlinqs on . This product uses the NVD API but is not endorsed or certified by the NVD.