CVE-2026-52810 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. This vulnerability is fixed in 0.14.3.
A vulnerability in Gogs' Git Smart HTTP handling could allow unauthorized write access to repositories. This issue arises because the authorization for POST requests to the 'git-receive-pack' endpoint is based on a client-supplied query parameter, which can be manipulated to misrepresent the type of access being requested. As a result, a user with only read permissions can inadvertently gain write access, particularly in instances where 'REQUIRE_SIGNIN_VIEW' is enabled, making all repositories writable for signed-in users.
Users can update to Gogs version 0.14.3, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184 | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8331 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/releases/tag/v0.14.3 | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | < 0.14.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |