{"schema":"vulnpedia.research/1","cve":"CVE-2026-20896","references":[{"url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4","tags":["vendor-advisory","exploit","WEB","ADVISORY"],"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","origins":[{"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"},{"source":"mitre","sourceId":"CISA-ADP","modified":"2026-07-07T17:00:46.549Z","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"},{"source":"nvd","sourceId":"CVE-2026-20896","modified":"2026-10-25T15:10:00.147","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"},{"source":"go","sourceId":"GO-2026-6051","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://github.com/go-gitea/gitea/security/advisories/GHSA-f75j-4cw6-rmx4"}]},{"url":"https://github.com/go-gitea/gitea/pull/38151","tags":["patch","WEB"],"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","origins":[{"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","url":"https://github.com/go-gitea/gitea/pull/38151"},{"source":"nvd","sourceId":"CVE-2026-20896","modified":"2026-10-25T15:10:00.147","url":"https://github.com/go-gitea/gitea/pull/38151"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://github.com/go-gitea/gitea/pull/38151"},{"source":"go","sourceId":"GO-2026-6051","url":"https://github.com/go-gitea/gitea/pull/38151"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://github.com/go-gitea/gitea/pull/38151"}]},{"url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3","tags":["release-notes","WEB"],"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","origins":[{"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3"},{"source":"nvd","sourceId":"CVE-2026-20896","modified":"2026-10-25T15:10:00.147","url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3"},{"source":"go","sourceId":"GO-2026-6051","url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://github.com/go-gitea/gitea/releases/tag/v1.26.3"}]},{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/","tags":["release-notes"],"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","origins":[{"source":"mitre","sourceId":"Gitea","modified":"2026-07-05T14:43:07.900Z","url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/"},{"source":"nvd","sourceId":"CVE-2026-20896","modified":"2026-10-25T15:10:00.147","url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4/"}]},{"url":"https://osv.dev/vulnerability/GHSA-f75j-4cw6-rmx4","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","origins":[{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://osv.dev/vulnerability/GHSA-f75j-4cw6-rmx4"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://osv.dev/vulnerability/GHSA-f75j-4cw6-rmx4"}]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20896","tags":["ADVISORY"],"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","origins":[{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20896"},{"source":"go","sourceId":"GO-2026-6051","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20896"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-20896"}]},{"url":"https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","origins":[{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9"},{"source":"go","sourceId":"GO-2026-6051","url":"https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://github.com/go-gitea/gitea/commit/99f8b3d9a1d32f4c39828e07971455a18191e0b9"}]},{"url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4","tags":["WEB"],"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","origins":[{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4"},{"source":"go","sourceId":"GO-2026-6051","url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://blog.gitea.com/release-of-1.26.3-and-1.26.4"}]},{"url":"https://github.com/go-gitea/gitea","tags":["PACKAGE"],"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","origins":[{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://github.com/go-gitea/gitea"},{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://github.com/go-gitea/gitea"}]},{"url":"https://osv.dev/vulnerability/GO-2026-6051","tags":["ADVISORY"],"source":"go","sourceId":"GO-2026-6051","modified":"2026-07-22T21:00:28.336016287Z","origins":[{"source":"go","sourceId":"GO-2026-6051","url":"https://osv.dev/vulnerability/GO-2026-6051"},{"source":"go","sourceId":"GO-2026-6051","modified":"2026-07-22T21:00:28.336016287Z","url":"https://osv.dev/vulnerability/GO-2026-6051"}]},{"source":"euvd","sourceId":"EUVD-2026-41614","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41614","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2026-41614","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-41614"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://www.linkedin.com/feed/update/urn:li:activity:7479652557561454592/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","url":"https://www.linkedin.com/feed/update/urn:li:activity:7479652557561454592/"}]},{"url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-083/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-083/"}]},{"url":"https://previdian.com/CVE-2026-20896","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","url":"https://previdian.com/CVE-2026-20896"}]},{"url":"https://vulncheck.com/xdb/0ede3f054e22","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"0ede3f054e22","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0ede3f054e22","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/0ede3f054e22"}]},{"url":"https://github.com/rz1027/CVE-2026-20896","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"0ede3f054e22","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"0ede3f054e22","modified":"2026-07-06T00:00:00Z","url":"https://github.com/rz1027/CVE-2026-20896"}]},{"url":"https://vulncheck.com/xdb/dac65188755e","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"dac65188755e","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"dac65188755e","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/dac65188755e"}]},{"url":"https://github.com/szybnev/cve-2026-20896-gitea-poc","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"dac65188755e","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"dac65188755e","modified":"2026-07-06T00:00:00Z","url":"https://github.com/szybnev/cve-2026-20896-gitea-poc"}]},{"url":"https://vulncheck.com/xdb/9beacb6c0f06","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"9beacb6c0f06","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9beacb6c0f06","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/9beacb6c0f06"}]},{"url":"https://github.com/XaocZenon/CVE-2026-20896","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"9beacb6c0f06","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"9beacb6c0f06","modified":"2026-07-06T00:00:00Z","url":"https://github.com/XaocZenon/CVE-2026-20896"}]},{"url":"https://vulncheck.com/xdb/04be6b5f087b","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"04be6b5f087b","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"04be6b5f087b","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/04be6b5f087b"}]},{"url":"https://github.com/EQSTLab/CVE-2026-20896","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"04be6b5f087b","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"04be6b5f087b","modified":"2026-07-06T00:00:00Z","url":"https://github.com/EQSTLab/CVE-2026-20896"}]},{"url":"https://vulncheck.com/xdb/635231d59316","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"635231d59316","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"635231d59316","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/635231d59316"}]},{"url":"https://github.com/judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"635231d59316","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"635231d59316","modified":"2026-07-06T00:00:00Z","url":"https://github.com/judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass"}]},{"url":"https://vulncheck.com/xdb/16efe72f2bf4","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"16efe72f2bf4","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"16efe72f2bf4","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/16efe72f2bf4"}]},{"url":"https://github.com/yym8538/CVE-2026-20896","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"16efe72f2bf4","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"16efe72f2bf4","modified":"2026-07-06T00:00:00Z","url":"https://github.com/yym8538/CVE-2026-20896"}]},{"url":"https://vulncheck.com/xdb/76608513f7ce","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"76608513f7ce","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"76608513f7ce","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/76608513f7ce"}]},{"url":"https://github.com/Raincombat/CVE-2026-20896-Gitea-CTF","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"76608513f7ce","modified":"2026-07-06T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"76608513f7ce","modified":"2026-07-06T00:00:00Z","url":"https://github.com/Raincombat/CVE-2026-20896-Gitea-CTF"}]}],"packages":[{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","url":"https://osv.dev/vulnerability/GHSA-f75j-4cw6-rmx4","ecosystem":"Go","name":"code.gitea.io/gitea","purl":"pkg:golang/code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.3"}]}],"databaseSpecific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f75j-4cw6-rmx4/GHSA-f75j-4cw6-rmx4.json"},"modified":"2026-07-22T21:11:39.289604207Z","origins":[{"source":"ghsa","sourceId":"GHSA-f75j-4cw6-rmx4","modified":"2026-07-22T21:11:39.289604207Z","url":"https://osv.dev/vulnerability/GHSA-f75j-4cw6-rmx4"}]},{"source":"go","sourceId":"GO-2026-6051","url":"https://osv.dev/vulnerability/GO-2026-6051","ecosystem":"Go","name":"code.gitea.io/gitea","purl":"pkg:golang/code.gitea.io/gitea","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.26.3"}]}],"ecosystemSpecific":{},"databaseSpecific":{"source":"https://vuln.go.dev/ID/GO-2026-6051.json"},"modified":"2026-07-22T21:00:28.336016287Z","origins":[{"source":"go","sourceId":"GO-2026-6051","modified":"2026-07-22T21:00:28.336016287Z","url":"https://osv.dev/vulnerability/GO-2026-6051"}]}],"pocCandidates":[{"url":"https://github.com/kaleth4/CVE-2026-20896","source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-07-06T17:21:41Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/kaleth4/CVE-2026-20896"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-07-06T17:21:41Z","url":"https://github.com/kaleth4/CVE-2026-20896"}],"tags":[]},{"url":"https://github.com/rz1027/CVE-2026-20896","source":"poc-in-github","sourceId":"CVE-2026-20896","description":"Public PoC and detector for CVE-2026-20896 (\"Gitea Docker: One Header, Any User\")","modified":"2026-08-05T16:00:45Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/rz1027/CVE-2026-20896"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-08-05T16:00:45Z","url":"https://github.com/rz1027/CVE-2026-20896"}],"tags":[]},{"url":"https://github.com/szybnev/cve-2026-20896-gitea-poc","source":"poc-in-github","sourceId":"CVE-2026-20896","description":"CVE-2026-20896 Gitea Docker X-WEBAUTH-USER auth bypass checker","modified":"2026-08-03T09:10:14Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/szybnev/cve-2026-20896-gitea-poc"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-08-03T09:10:14Z","url":"https://github.com/szybnev/cve-2026-20896-gitea-poc"}],"tags":[]},{"url":"https://github.com/XaocZenon/CVE-2026-20896","source":"poc-in-github","sourceId":"CVE-2026-20896","description":"this is a modified POC of rz1027 for CVE-2026-20896","modified":"2026-07-18T14:07:16Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/XaocZenon/CVE-2026-20896"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-07-18T14:07:16Z","url":"https://github.com/XaocZenon/CVE-2026-20896"}],"tags":[]},{"url":"https://github.com/EQSTLab/CVE-2026-20896","source":"poc-in-github","sourceId":"CVE-2026-20896","description":"Gitea Docker Image Authentication Bypass","modified":"2026-08-04T00:22:07Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/EQSTLab/CVE-2026-20896"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-08-04T00:22:07Z","url":"https://github.com/EQSTLab/CVE-2026-20896"}],"tags":[]},{"url":"https://github.com/judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass","source":"poc-in-github","sourceId":"CVE-2026-20896","description":"An explanation and PoC to exploit CVE-2026-20896 Authentication Bypass Vulnerability on Gitea. Being able to steal session tokens for valid users in the Gitea instance.","modified":"2026-09-29T15:17:26Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-09-29T15:17:26Z","url":"https://github.com/judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass"}],"tags":[]},{"url":"https://github.com/yym8538/CVE-2026-20896","source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-09-25T11:50:15Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/yym8538/CVE-2026-20896"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-09-25T11:50:15Z","url":"https://github.com/yym8538/CVE-2026-20896"}],"tags":[]},{"url":"https://github.com/Raincombat/CVE-2026-20896-Gitea-CTF","source":"poc-in-github","sourceId":"CVE-2026-20896","description":"CVE-2026-20896 Gitea Docker CTF Challenge","modified":"2026-10-17T09:04:55Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2026-20896","url":"https://github.com/Raincombat/CVE-2026-20896-Gitea-CTF"},{"source":"poc-in-github","sourceId":"CVE-2026-20896","modified":"2026-10-17T09:04:55Z","url":"https://github.com/Raincombat/CVE-2026-20896-Gitea-CTF"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"0ede3f054e22","url":"https://vulncheck.com/xdb/0ede3f054e22","cve":"CVE-2026-20896","dateAdded":"2026-07-06T12:11:42Z","modified":"2026-07-06T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/rz1027/CVE-2026-20896","observations":[{"dateAdded":"2026-07-06T12:11:42Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"0ede3f054e22","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/0ede3f054e22"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"dac65188755e","url":"https://vulncheck.com/xdb/dac65188755e","cve":"CVE-2026-20896","dateAdded":"2026-07-07T20:31:16Z","modified":"2026-07-06T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/szybnev/cve-2026-20896-gitea-poc","observations":[{"dateAdded":"2026-07-07T20:31:16Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"dac65188755e","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/dac65188755e"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"9beacb6c0f06","url":"https://vulncheck.com/xdb/9beacb6c0f06","cve":"CVE-2026-20896","dateAdded":"2026-07-17T23:59:33Z","modified":"2026-07-06T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/XaocZenon/CVE-2026-20896","observations":[{"dateAdded":"2026-07-17T23:59:33Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"9beacb6c0f06","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/9beacb6c0f06"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"04be6b5f087b","url":"https://vulncheck.com/xdb/04be6b5f087b","cve":"CVE-2026-20896","dateAdded":"2026-07-31T14:01:30Z","modified":"2026-07-06T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/EQSTLab/CVE-2026-20896","observations":[{"dateAdded":"2026-07-31T14:01:30Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"04be6b5f087b","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/04be6b5f087b"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"635231d59316","url":"https://vulncheck.com/xdb/635231d59316","cve":"CVE-2026-20896","dateAdded":"2026-08-17T11:56:37Z","modified":"2026-07-06T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/judgedbykira/CVE-2026-20896-Gitea-Authentication-Bypass","observations":[{"dateAdded":"2026-08-17T11:56:37Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"635231d59316","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/635231d59316"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"16efe72f2bf4","url":"https://vulncheck.com/xdb/16efe72f2bf4","cve":"CVE-2026-20896","dateAdded":"2026-09-25T20:29:36Z","modified":"2026-07-06T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/yym8538/CVE-2026-20896","observations":[{"dateAdded":"2026-09-25T20:29:36Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"16efe72f2bf4","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/16efe72f2bf4"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"76608513f7ce","url":"https://vulncheck.com/xdb/76608513f7ce","cve":"CVE-2026-20896","dateAdded":"2026-10-15T21:03:49Z","modified":"2026-07-06T00:00:00Z","exploitType":"initial-access","repositoryUrl":"https://github.com/Raincombat/CVE-2026-20896-Gitea-CTF","observations":[{"dateAdded":"2026-10-15T21:03:49Z","exploitType":"initial-access"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"76608513f7ce","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/xdb/76608513f7ce"}]}],"vendorStatements":[],"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2026-07-06T00:00:00Z","modified":"2026-07-06T00:00:00Z","requiredAction":"Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Gitea","product":"Gitea Open Source Git Server","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","modified":"2026-07-06T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","catalog":"VulnCheck KEV","kind":"report","url":"https://www.linkedin.com/feed/update/urn:li:activity:7479652557561454592/","dateAdded":"2026-07-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","url":"https://www.linkedin.com/feed/update/urn:li:activity:7479652557561454592/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","catalog":"VulnCheck KEV","kind":"report","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-083/","dateAdded":"2026-07-08T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","url":"https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2026-083/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","catalog":"VulnCheck KEV","kind":"report","url":"https://previdian.com/CVE-2026-20896","dateAdded":"2026-10-20T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2026-20896","url":"https://previdian.com/CVE-2026-20896"}]}]}