Gitea Docker Reverse Proxy Authentication Spoofing

Gitea Docker images through version 1.26.2 contain a critical authentication bypass vulnerability where the default configuration REVERSE_PROXY_TRUSTED_PROXIES=* permits any source IP to forge reverse-proxy authentication headers like X-WEBAUTH-USER. This allows unauthenticated attackers to impersonate arbitrary users, including administrators, without credentials. Organizations running Gitea in containerized environments with reverse-proxy authentication enabled face immediate risk of unauthorized access, account takeover, and potential supply chain compromise if Gitea hosts repositories or CI/CD pipelines.

While this CVE maps to CWE-284 (Improper Access Control) rather than specific MITRE ATT&CK techniques, Casky's security skills would detect the underlying attack patterns through behavioral analysis of authentication anomalies and privilege escalation attempts. Practitioners using Casky would observe findings related to suspicious authentication header patterns, impossible travel scenarios (requests from unexpected source IPs suddenly authenticating as high-privilege users), and configuration drift detection identifying overly permissive proxy settings. Extended reasoning across Casky's 754 mapped skills would correlate these signals—examining credential usage, access control decisions, and network boundary controls—to surface that legitimate reverse-proxy headers are being spoofed, enabling practitioners to identify and remediate this dangerous misconfiguration before exploitation occurs.