Skip to content
securitytabs

CVE-2026-20896

Critical9.8

Gitea Open Source Git Server: Gitea Docker image trusts spoofable reverse-proxy headers by defaulttitle from the CVE record

Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user when reverse-proxy authentication headers such as X-WEBAUTH-USER are enabled.

CVSS
9.8v3.1
EPSS (exploit probability)
2.8%86th pct
CISA KEV
Not listed

EPSS trendFIRST daily scores, last 90 days

FIRST EPSS held steady from 2.8% on 2026-09-24 to 2.8% on 2026-10-25, ranging 2.8%–2.8% across 31 daily scores.
2026-09-24 → 2026-10-25 · 31 days · 2.8%–2.8%
Daily values
FIRST EPSS daily scores for this CVE
Score dateEPSSPercentile
2026-10-252.8%86.1%
2026-10-242.8%86.2%
2026-10-232.8%86.1%
2026-10-222.8%86.1%
2026-10-212.8%86.1%
2026-10-202.8%86.0%
2026-10-192.8%86.0%
2026-10-182.8%86.0%
2026-10-172.8%86.0%
2026-10-162.8%86.0%
2026-10-152.8%86.0%
2026-10-142.8%86.0%
2026-10-132.8%85.9%
2026-10-122.8%85.9%
2026-10-112.8%85.9%
2026-10-102.8%85.8%
2026-10-092.8%85.8%
2026-10-082.8%85.8%
2026-10-072.8%85.8%
2026-10-062.8%85.8%
2026-10-052.8%85.8%
2026-10-042.8%85.7%
2026-10-032.8%85.7%
2026-10-022.8%85.7%
2026-10-012.8%85.7%
2026-09-302.8%85.7%
2026-09-292.8%85.7%
2026-09-272.8%85.7%
2026-09-262.8%85.7%
2026-09-252.8%85.6%
2026-09-242.8%85.6%

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Learn

Why it happened and what stops it

The weakness (CWE)

How attackers use it (ATT&CK)

Typical for this kind of weakness across CISA KEV exploits (CTID), not specific to this CVE.

Controls that mitigate it (NIST SP 800-53)

Coverage1 article

References

Facts sourced from NVD, FIRST EPSS, and CISA KEV. Last synced 2026-10-26 06:51 UTC.

  • CVSS & description: NVD 2.0, fetched 2026-10-26 06:51 UTC
  • EPSS: FIRST EPSS, fetched 2026-10-26 06:51 UTC; score date 2026-10-25
  • KEV: CISA KEV, fetched 2026-10-26 06:51 UTC