CVE-2026-20896 Gitea X-WEBAUTH-USER Header Injection Admin Takeover

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•7

Detects HTTP requests to Gitea instances containing the X-WEBAUTH-USER header, which facilitates user impersonation when Gitea is misconfigured with 'REVERSE_PROXY_TRUSTED_PROXIES = *' in a Docker environment. This vulnerability (CVE-2026-20896) allows an unauthenticated attacker to impersonate any user, including administrators.