Gitea auth bypass flaw let anyone become admin via single HTTP header

A critical vulnerability (CVE scored 9.8) in Gitea, a popular self-hosted Git platform, allowed unauthenticated users to gain full admin access by sending a single crafted HTTP header. The flaw stemmed from the official Docker image setting REVERSE_PROXY_TRUSTED_PROXIES to a wildcard asterisk, meaning Gitea trusted the X-WEBAUTH-USER header from any IP address. When reverse-proxy authentication was enabled, an attacker could simply pass 'X-WEBAUTH-USER: admin' to instantly access private repositories, the admin dashboard, and user lists — no password or token required. A security researcher reproduced the attack end-to-end on an isolated lab running Gitea 1.26.2, successfully reading private files containing fake credentials within seconds. Sysdig reported active exploitation attempts in the wild shortly after a proof-of-concept became public, underscoring the real-world risk of insecure defaults in official container images.