CVE-2026-52815 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.
An unauthenticated information disclosure vulnerability exists in Gogs versions prior to 0.14.3. The vulnerability is located in the 'GET /api/v1/orgs/:orgname/teams' endpoint, which returns all teams for any organization without requiring authentication. This issue arises because the route group does not include the necessary authentication middleware, allowing any unauthenticated caller to access team IDs, names, descriptions, and permission levels.
Users are advised to update to Gogs version 0.14.3 or later, and to add the 'reqToken()' middleware to the organization teams route group to enforce authentication.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2026CISA-ADP
Assessed Jun 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | < 0.14.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 25, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2026 | New CVE Received | [email protected] |