Hackers exploit critical auth bypass in Gitea Docker image

Hackers are actively exploiting a critical vulnerability in the official Docker image for the Gitea self-hosted Git service that allows attackers to impersonate any user, including administrators.
Hosted on MSN

A Gitea container flaw just surfaced that lets anyone pull private container images from the cloud — more than 30,000 deployments have been wide open for almost four years

If your team runs a self-hosted Gitea instance with the built-in container registry turned on, there is a real chance that every private container image you have stored has been accessible to the open ...
Tech Times

Gitea Docker Flaw Now Actively Probed: One Header Grants Admin Access to Source Code

Sysdig detected attackers probing the CVSS 9.8 authentication bypass 13 days after the advisory, using one HTTP header to claim admin access to source code, secrets, and CI/CD pipelines. Teams running ...