The headline needs to capture: Gitea auth bypass, CVE, Docker default config issue, reproduced attack.

Short summary

A critical Gitea CVE allowed anyone to bypass authentication by sending a single HTTP header, because the official Docker image set REVERSE_PROXY_TRUSTED_PROXIES to '*' — trusting any source. The author reproduced the full attack on a lab instance, extracting private repo contents and gaining admin panel access with no credentials. The real lesson is broader: dangerous defaults in official Docker images create vulnerabilities that operators never introduced themselves.

• •Gitea Docker image shipped with REVERSE_PROXY_TRUSTED_PROXIES='*', allowing unauthenticated admin access via a single header
• •Full attack reproduced: private repo contents and admin dashboard accessible with no password or token
• •Broader issue is dangerous defaults in official container images that operators blindly trust

Generated with AI, which can make mistakes.