This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Gitea fixes 2 vulnerabilities
Gitea (an open-source self-hosted Git service for repository management) fixes 2 vulnerabilities in version 1.26.3 [1][2].
Allows an unauthenticated remote attacker to impersonate any user, including an administrator, by means of a forged HTTP header, due to an incorrect default reverse proxy configuration in the official Docker containers [1].
The vulnerability is present in product:
- Gitea (Docker image); <=1.26.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2026-20896 at cve.org, NVD
- CWE-290: Authentication Bypass by Spoofing at cwe.mitre.org
The vulnerability was publicly disclosed 20. 6. 2026.
Allows an authenticated remote attacker to send requests to internal network addresses due to insufficient filtering of destination addresses in the webhook and migration functionality [1]. At the time of writing, no CVSS severity rating had yet been published for this vulnerability.
The vulnerability is present in product:
- Gitea; <=1.26.2
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
More information:
- CVE-2026-22874 at cve.org, NVD
- CWE-918: Server-Side Request Forgery (SSRF) at cwe.mitre.org
The vulnerability was publicly disclosed 20. 6. 2026.
Links
By CESNET, z.s.p.o. Henrieta Paločková on 26. 6. 2026.