Gitea Docker images use REVERSE_PROXY_TRUSTED_PROXIES=* by default, meaning that any network source can present authentication headers such as X‑WEBAUTH‑USER and the application will accept them unfiltered. This flaw allows an attacker to fabricate a header that claims to be any registered user, including administrators, and thereby perform actions with elevated privileges. As a result, the attacker can commit code, modify repositories, and potentially impact overall system integrity and confidentiality. The weakness is an access‑control failure, classified as CWE‑284.

The vulnerability affects the Gitea Open Source Git Server Docker images up to and including version 1.26.2. Versions 1.26.3 and later contain the correction that removes the default wildcard trust setting.

The CVSS score of 9.8 indicates a critical severity. The EPSS score of < 1% suggests a very low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a malicious client that sends‑USER header to a Gitea instance behind an arbitrary reverse proxy whose REVERSE_PROXY_TRUSTED_PROXIES is set to *.