CVE-2026-20896 Gitea Docker X-WEBAUTH-USER Admin Impersonation

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•1•12

Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).