PT-2026-51633 · Gogs · Gogs

Published 2026-06-23 · Updated 2026-06-24 · CVE-2026-52815

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description Gogs contains an information disclosure issue where the 'GET /api/v1/orgs/:orgname/teams' endpoint returns all teams for any organization without requiring authentication. This occurs because the route group lacks the reqToken() middleware, and the listTeams() handler does not perform authentication checks. Consequently, an unauthenticated caller can access team IDs, names, descriptions, and permission levels (read, write, admin, or owner). This allows for the enumeration of private or internal teams, mapping of organizational structures, and identification of high-value targets.

Recommendations Update to version 0.14.3 or later. As a temporary workaround, restrict access to the 'GET /api/v1/orgs/:orgname/teams' endpoint to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-52815

GHSA-744X-3838-5R56

Affected Products

Gogs

References · 7

• https://osv.dev/vulnerability/GHSA-744x-3838-5r56 · Vendor Advisory
• https://github.com/gogs/gogs/commit/2ebc0e27069deade992219e10a89fbc44bec8bb9 · Note
• https://github.com/gogs/gogs/pull/8336 · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56 · Note
• https://github.com/gogs/gogs/releases/tag/v0.14.3 · Note
• https://github.com/gogs/gogs · Note
• https://twitter.com/pdnuclei_bot/status/2069692039126761576 · Twitter Post