The vulnerability is an authentication bypass via unvalidated reverse proxy headers. When Gogs enables reverse proxy authentication, it accepts a header such as X‑WEBAUTH‑USER directly from client requests without confirming that the request originated from a trusted reverse proxy. This weakness is a form of insecure trust of external authentication info (CWE‑290). As a result, any remote user who can reach the Gogs service may forge this header, causing Gogs to authenticate as any user or automatically create a new account. This allows full impersonation and unauthorized access, violating confidentiality and integrity.

Affected are installations of the Gogs open‑source Git service running any version prior to v0.14.3 when reverse proxy authentication is enabled.

The CVSS score of 7.7 indicates a high severity. EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog. The attacker only needs network access to the Gogs instance. By sending a request with a forged X‑WEBAUTH‑USER header, the attacker can impersonate any existing user or create a new account, effectively bypassing authentication and gaining full control over the repository server.