Tag

#gitea

1 story tagged gitea.

Abstract data art representing a single HTTP header piercing through a layered authentication barrier, symbolizing the Gitea Docker auth bypass CVE-2026-20896 where one X-WEBAUTH-USER header lets attackers impersonate any user including admins across approximately 6,200 exposed instances.

Gitea Docker auth bypass lets attackers impersonate admins

A critical Gitea Docker auth bypass, CVE-2026-20896, lets attackers impersonate any user with one HTTP header. Over 6,200 instances are exposed online.

Lars Cornelissen · Jul 11, 2026