CVE-2026-25119: Gogs.io/gogs Authentication Bypass Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-w6j9-vw59-27wv",
  "modified" : "2026-07-21T13:16:36Z",
  "published" : "2026-06-22T17:09:51Z",
  "aliases" : [ "CVE-2026-25119" ],
  "summary" : "Gogs has an Authentication Bypass via Unvalidated Reverse Proxy Headers",
  "details" : "## Summary\n\nWhen `ENABLE_REVERSE_PROXY_AUTHENTICATION` is enabled, Gogs accepts the configured authentication header (default: `X-WEBAUTH-USER`) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication.\n\n## Root Cause\n\nThe vulnerability exists because Gogs reads the authentication header directly from the incoming HTTP request without any verification that the header was set by a trusted reverse proxy.\n\n### Vulnerable Code Flow\n\nIn `internal/context/auth.go` lines 206-234:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n    // ... existing auth checks ...\n\n    if uid <= 0 {\n        if conf.Auth.EnableReverseProxyAuthentication {\n            // Reads header DIRECTLY from client request - NO VALIDATION!\n            webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n            if len(webAuthUser) > 0 {\n                user, err := store.GetUserByUsername(ctx.Req.Context(), webAuthUser)\n                if err != nil {\n                    if !database.IsErrUserNotExist(err) {\n                        log.Error(\"Failed to get user by name: %v\", err)\n                        return nil, false, false\n                    }\n\n                    // Check if enabled auto-registration.\n                    if conf.Auth.EnableReverseProxyAutoRegistration {\n                        // Creates new user with forged username!\n                        user, err = store.CreateUser(\n                            ctx.Req.Context(),\n                            webAuthUser,\n                            gouuid.NewV4().String()+\"@localhost\",\n                            database.CreateUserOptions{\n                                Activated: true,\n                            },\n                        )\n                        if err != nil {\n                            log.Error(\"Failed to create user %q: %v\", webAuthUser, err)\n                            return nil, false, false\n                        }\n                    }\n                }\n                // Returns user as authenticated without any verification!\n                return user, false, false\n            }\n        }\n        // ... fallback to basic auth ...\n    }\n    // ...\n}\n```\n\nThe code has **zero validation** that:\n1. The request came through a reverse proxy\n2. The header was set by the proxy (not the client)\n3. Gogs is actually behind a reverse proxy\n4. The direct access to Gogs is restricted\n\nThe vulnerability occurs when:\n- Gogs is publicly accessible (e.g., `0.0.0.0:3000`)\n- `ENABLE_REVERSE_PROXY_AUTHENTICATION = true`\n\n## Proof of Concept\n\n### Prerequisites\n\nGogs instance with the following configuration in `custom/conf/app.ini`:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = true\n```\n\nAn attacker can impersonate any user including administrators:\n\n```bash\n# Become admin instantly\ncurl http://gogs.example.com/ -H \"X-WEBAUTH-USER: <username>\"\n```\n\n<img width=\"1835\" height=\"1143\" alt=\"impersonation_example\" src=\"https://github.com/user-attachments/assets/bae60772-5eb3-4f54-9fe0-5db01595bd56\" />\n\n## Recommended Fixes\n\nAdd validation to ensure headers come from trusted sources:\n\n```go\nfunc authenticatedUser(store AuthStore, ctx *macaron.Context, sess session.Store) (_ *database.User, isBasicAuth, isTokenAuth bool) {\n    // ... existing code ...\n\n    if uid <= 0 {\n        if conf.Auth.EnableReverseProxyAuthentication {\n            // Validate request is from trusted proxy\n            if !isRequestFromTrustedProxy(ctx.Req) {\n                log.Warn(\"Reverse proxy auth header received from untrusted source: %s\", ctx.RemoteAddr())\n                return nil, false, false\n            }\n\n            webAuthUser := ctx.Req.Header.Get(conf.Auth.ReverseProxyAuthenticationHeader)\n            // ... rest of the code ...\n        }\n    }\n    // ...\n}\n\n// New validation function\nfunc isRequestFromTrustedProxy(req *http.Request) bool {\n    // Check if request is from localhost/trusted IPs\n    remoteIP := getRemoteIP(req)\n\n    // Only accept from localhost by default\n    if remoteIP.IsLoopback() {\n        return true\n    }\n\n    // Check against configured trusted proxy IPs\n    for _, trustedIP := range conf.Auth.TrustedProxyIPs {\n        if remoteIP.String() == trustedIP {\n            return true\n        }\n    }\n\n    return false\n}\n```\n\nAdd configuration option:\n\n```ini\n[auth]\nENABLE_REVERSE_PROXY_AUTHENTICATION = false\nREVERSE_PROXY_AUTHENTICATION_HEADER = X-WEBAUTH-USER\n; Comma-separated list of trusted proxy IPs (default: 127.0.0.1)\nTRUSTED_PROXY_IPS = 127.0.0.1,::1\n; Whether to require trusted proxy validation (recommended: true)\nREQUIRE_TRUSTED_PROXY = true\n```\n\n## References\n\n- [CWE-290: Authentication Bypass by Spoofing](https://cwe.mitre.org/data/definitions/290.html)\n- [OWASP: Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)\n- [OWASP Top 10 2021 - A07: Identification and Authentication Failures](https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/)",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "gogs.io/gogs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.14.3"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 0.14.2"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25119"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/pull/8264"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/commit/0089c4c8e5b8d99eb6e5c8727f8f40d765f1f58a"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gogs/gogs"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/releases/tag/v0.14.3"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-290" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-06-22T17:09:51Z",
    "nvd_published_at" : "2026-06-24T21:16:52Z"
  }
}