Skip to content
OriginalConnect AISign inSign up free
Image: SecurityOnline

SecurityOnlineDo Son

Gitea auth flaw lets attackers hijack admin accounts via SSRF

Part of the CVE-2026-20896 story · since 25 Jun

Quiet for 12 weekslast report 26 Aug5 articles4 outlets
25 Jun · SecurityOnline first7 Sep2 OctNowThis article1st of 5
  • Thu 25 Jun, 02:21 UTC. SecurityOnline, first report. Gitea auth flaw lets attackers hijack admin accounts via SSRF. This article, 1st of 5.
  • Mon 6 Jul, 17:41 UTC. The Hacker News, its first report on the story. Attackers Exploit New Gitea Docker Bug CVE-2026-20896.
  • Tue 7 Jul, 17:31 UTC. SecurityWeek, its first report on the story. Critical Gitea Flaw Under Active Exploitation, Researchers Warn.
  • Tue 7 Jul, 22:31 UTC. Security Affairs, its first report on the story. CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth.
  • Wed 26 Aug, 05:50 UTC. SecurityWeek. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28.

The article discusses two critical security vulnerabilities affecting Gitea, a popular self-hosted platform for code management. These vulnerabilities, CVE-2026-20896 and CVE-2026-22874, allow attackers to bypass authentication and perform Server-Side Request Forgery (SSRF) attacks, potentially gaining full control over administrative accounts and sensitive cloud infrastructure. The first vulnerability has a CVSS score of 9.8 and is due to misconfigured reverse proxy authentication.

The second, with a CVSS score of 9.6, arises from an incomplete SSRF allow-list. Both vulnerabilities affect Gitea versions 1.26.2 and earlier, requiring an immediate upgrade to 1.26.3 for protection.

How the story developed

All 5 articles
Quiet for 12 weekslast report 26 Aug5 articles4 outlets

5 articles from 4 outlets since 25 Jun. Quiet since 26 Aug. This was the first report.

Now25 Jun29246825 AugFirst reportSecurityOnline · 25 Jun, 02:21Picked up againafter 12 days quietPicked up againafter 7 weeks quiet
  • Thu 25 Jun, 02:21 UTC. SecurityOnline, first report. Gitea auth flaw lets attackers hijack admin accounts via SSRF. This article, 1st of 5.
  • Mon 6 Jul, 17:41 UTC. The Hacker News, its first report on the story. Attackers Exploit New Gitea Docker Bug CVE-2026-20896.
  • Tue 7 Jul, 17:31 UTC. SecurityWeek, its first report on the story. Critical Gitea Flaw Under Active Exploitation, Researchers Warn.
  • Tue 7 Jul, 22:31 UTC. Security Affairs, its first report on the story. CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth.
  • Wed 26 Aug, 05:50 UTC. SecurityWeek. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 28.
  • CVE not in KEV
  • No CVE
  • Larger: an outlet’s first report
  • Coverage over time
  • Quiet time, folded
Show all 5 articles as a list
  1. Thu 25 JunDay 01
    1. Gitea auth flaw lets attackers hijack admin accounts via SSRF02:21 · SecurityOnline · First report · This article, 1st of 5

  2. Quiet for 12 days

    Mon 6 JulDay 111
    1. Attackers Exploit New Gitea Docker Bug CVE-2026-2089617:41 · The Hacker News · Picked up again
  3. Tue 7 JulDay 122
    1. Critical Gitea Flaw Under Active Exploitation, Researchers Warn17:31 · SecurityWeek
    2. CVE-2026-20896: Gitea Docker flaw lets attackers bypass auth22:31 · Security Affairs

  4. Quiet for 7 weeks

    Wed 26 AugDay 621
    1. CISA Warns of Exploited Gitea Flaw CVE-2026-60004 Patch by Aug 2805:50 · SecurityWeek · Picked up again

Sources

CyberSIXTSignal over noise
Sign inSign up free

Updated