szybnev/cve-2026-20896-gitea-poc

This repository is a proof-of-concept checker for CVE-2026-20896, a real security vulnerability in official Gitea Docker images. Gitea is a self-hosted alternative to GitHub, letting teams run their own git server. The README is explicit that this tool is meant only for authorized red team or penetration testing work, not for attacking systems you don't have permission to test. The vulnerability itself comes from a configuration mistake in Gitea's Docker images up to and including version 1.26.2. When an administrator turned on reverse proxy authentication, Gitea was set to trust a header called X-WEBAUTH-USER from any source that could reach the container directly, even if that source bypassed the reverse proxy that was supposed to check identity first. In practice, this meant someone could send a single request with that header set to a known or guessed username and be treated as if they were already logged in as that person. If the impersonated account happened to be an administrator, the result could be full control over the Gitea instance and its repositories. The README notes this checker does not claim to give access to the underlying server itself, only to the Gitea application. The checker works by first loading the target's home page and reading the Gitea version from the footer text. If the version is already 1.26.3 or newer, meaning it has been patched, the tool skips testing by default. Otherwise it sends requests with the suspicious header set to each username you provide and looks at the resulting page title to see if it resembles a logged-in dashboard for that user. It is written in Go, builds with a single command, and needs no third party Go dependencies. It supports checking multiple targets at once, reading usernames from a file, adjusting concurrency and timeouts, saving results in JSONL format, and a dry run mode that does not send real requests. A bash script fallback is also included. The README even walks through setting up a local, deliberately vulnerable Gitea container in Docker so you can safely test the tool before pointing it at anything real, plus clear steps for cleanup and for patching an actual affected instance.