Researchers warn Gitea CVE-2026-20896 is now being actively exploited

Researchers are warning that CVE-2026-20896, a critical authentication bypass affecting Gitea Docker deployments using reverse-proxy authentication, is now seeing active exploitation. Under specific misconfigurations, attackers can spoof the X-WEBAUTH-USER header to impersonate arbitrary users, potentially leading to full repository compromise. The issue has been fixed in Gitea 1.26.4 (and corresponding patched releases for supported branches), so administrators should update as soon as possible. If you’re using reverse-proxy authentication, it’s also worth reviewing your proxy configuration to ensure authentication headers cannot be supplied by untrusted clients.