PT-2026-6756 · Gogs · Gogs

Odgrso · Published 2026-02-06 · Updated 2026-03-03 · CVE-2026-23632

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4

Description Gogs, a self-hosted Git service, has an issue where the API endpoint ''PUT /repos/:owner/:repo/contents/'' does not enforce write permissions correctly. It allows modification of repository contents using a token with only read permission. This occurs because the repoAssignment() function does not adequately verify permissions before invoking PutContents(), which then calls UpdateRepoFile(), leading to commit creation and a git push operation. The username and password are not directly involved in this issue. The vulnerable parameter is the file path specified in the request to the ''PUT /repos/:owner/:repo/contents/'' endpoint.

Recommendations Update Gogs to version 0.13.4 or later.

Exploit

Fix

Incorrect Authorization

Missing Authorization

Weakness Enumeration

CWE-863

CWE-862

Related Identifiers

CVE-2026-23632

GHSA-5QHX-GWFJ-6JQR

GO-2026-4450

SUSE-SU-2026:0757-1

Affected Products

Gogs

References · 117

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23632.json · Exploit
• https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23632 · Security Note
• https://osv.dev/vulnerability/GHSA-5qhx-gwfj-6jqr · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23632 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4450 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/gogs/gogs/pull/8102/commits/b6afcdb2e8d291e2adaaf6a8b7f88d240606515d · Note
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/releases/tag/v0.13.4 · Note
• https://suse.com/security/cve/CVE-2017-18912 · Note
• https://suse.com/security/cve/CVE-2025-14435 · Note
• https://suse.com/security/cve/CVE-2026-24122 · Note
• https://suse.com/security/cve/CVE-2026-26205 · Note
• https://suse.com/security/cve/CVE-2017-18911 · Note