PT-2026-51628 · Gogs · Gogs

Published 2026-06-23 · Updated 2026-06-23 · CVE-2026-52810

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Gogs (affected versions not specified)

Description Gogs contains an authorization bypass in its Git Smart HTTP handler for repository RPCs. The system determines the authorization policy based on the client-supplied service query parameter rather than the actual RPC path being executed. Specifically, a request sent to the write endpoint '/repo.git/git-receive-pack' can be incorrectly treated as a read operation if the service parameter is set to git-upload-pack (which is used for fetch/read operations).

While the authorization is evaluated as a read operation, the route dispatch still executes the receive-pack code path, allowing users with only read permissions to write to a repository. This is particularly impactful in instances where REQUIRE SIGNIN VIEW is set to true, as any signed-in user could potentially write to any public repository. Additionally, the use of force push could lead to data loss or availability issues by overriding existing code without leaving a history.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2026-52810

GHSA-WMFG-5P4H-5FW3

Affected Products

Gogs

References · 7

• https://osv.dev/vulnerability/GHSA-wmfg-5p4h-5fw3 · Vendor Advisory
• https://github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184 · Note
• https://github.com/gogs/gogs/pull/8331 · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.3 · Note
• https://github.com/gogs/gogs · Note
• https://twitter.com/dailycve/status/2069483729584554431 · Twitter Post