CVE-2026-52800 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be added to the Owners team. As a result, the attacker gains organization owner–equivalent privileges. This vulnerability is fixed in 0.14.3.
A vulnerability in Gogs, prior to version 0.14.3, allows for unauthorized management of organization team members through GET requests, lacking proper Cross-Site Request Forgery (CSRF) protection. This issue enables an attacker to add a user to the Owners team, thereby granting them equivalent privileges as an organization owner. The vulnerability arises because team management actions can be performed via GET requests, bypassing CSRF safeguards, and is particularly concerning for logged-in organization owners who may be tricked into clicking a malicious link.
Users can update to Gogs version 0.14.3 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-pwx3-qcgw-vh7h | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/commit/070df61ecd14c75b0aca93090f860b87ab17ac19 | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8321 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/releases/tag/v0.14.3 | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-pwx3-qcgw-vh7h | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-352 | Cross-Site Request Forgery (CSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | <= 0.14.3 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 26, 2026 | CVE Modified | CISA-ADP |
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |