A direct line to the Gitea container turns reverse-proxy login into a fake login. If the instance is reachable outside the intended proxy path, a single username header can make it accept the attacker as that user and hand over private repos, CI/CD config, deploy keys, and secrets.
The flaw affects Gitea official Docker images before 1.26.3. Researchers say exploitation started 13 days after disclosure, and internet-facing instances are exposed if direct HTTP reaches the container instead of only trusted proxy traffic.
The patch changes reverse-proxy authentication to opt in, and that matters because the danger is not one stolen account page. It is a full trust break in a developer platform that can expose code and the credentials stored with it.