PT-2026-23487 · Gogs · Gogs

Rezmoss · Published 2026-02-13 · Updated 2026-03-25 · CVE-2026-26196

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.2

Description The Gogs API accepts tokens in URL parameters, specifically token and access token. This can lead to information disclosure as these tokens may be logged, stored in browser history, or sent in referrer headers. The API checks for tokens in URL query parameters before checking the Authorization header. Token-authenticated requests are accepted by API routes. This allows for potential reuse of tokens until they are revoked.

Recommendations Versions prior to 0.14.2 should be updated to version 0.14.2. Authentication headers should be used exclusively for token transmission. Token parameters should be blocked at the proxy or WAF level. Query strings should be scrubbed from logs. A strict referrer policy should be set.

Exploit

Fix

Weakness Enumeration

CWE-598

Related Identifiers

BDU:2026-06148

CVE-2026-26196

GHSA-X9P5-W45C-7FFC

GO-2026-4619

SUSE-SU-2026:1042-1

Affected Products

Gogs

References · 140

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/26xxx/CVE-2026-26196.json · Exploit
• https://github.com/gogs/gogs/commit/295bfba72993c372e7b338438947d8e1a6bed8fd · Patch
• https://github.com/gogs/gogs/security/advisories/GHSA-x9p5-w45c-7ffc · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x9p5-w45c-7ffc · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:1042-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-26196 · Security Note
• https://osv.dev/vulnerability/GO-2026-4619 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-26196 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06148 · Security Note
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.2 · Note
• https://github.com/gogs/gogs/pull/8177 · Note
• https://suse.com/security/cve/CVE-2026-28280 · Note
• https://suse.com/security/cve/CVE-2026-22728 · Note
• https://suse.com/security/cve/CVE-2026-32319 · Note