CVE-2026-20896 Gitea Default Docker Unauthenticated Admin Account Creation

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•2

Detects the exploitation of CVE-2026-20896 in Gitea, where an unauthenticated attacker sends a crafted POST request to user registration or installation endpoints. The rule triggers when this network activity is followed by the creation of a new user account with administrative roles within a 10-minute window, indicating potential privilege escalation.