CVE-2026-82402 Details
Description
Gogs is an open source self-hosted Git service. Prior to 0.15.0+dev, an unauthenticated attacker can provide a backslash-containing target to the /redirect endpoint, and similar post-action redirect flows are also affected. internal/urlx/urlx.go IsSameSite validates a normalized form of the target while cmd/gogs/internal/web/web.go getRedirect and other callers use the original value in the Location response. This backslash normalization mismatch lets browsers interpret the Location value as a scheme-relative external URL, allowing links on a trusted Gogs domain to redirect victims to attacker-controlled content for phishing. This vulnerability is fixed in 0.15.0+dev.
A vulnerability allowing open redirection has been identified in Gogs, an open-source self-hosted Git service, in versions prior to 0.15.0+dev. The issue arises in the '/redirect' endpoint, where an unauthenticated attacker can manipulate the redirect target by including backslashes. This exploitation takes advantage of a mismatch in how the target URL is normalized and validated, leading to unauthorized redirections to external, potentially malicious, sites.
Users can upgrade to Gogs version 0.15.0+dev or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/gogs/gogs/security/advisories/GHSA-3g28-2vwg-gxq6 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/gogs/gogs/blob/main/CHANGELOG.md#0150dev-main | [email protected] | Release NotesVendor |
| https://github.com/gogs/gogs/commit/0aa820e6d572771551871c0b5f5f32dffc565e3e | [email protected] | Source CodeVendor |
| https://github.com/gogs/gogs/pull/8391 | [email protected] | Issue TrackingVendor |
| https://github.com/gogs/gogs/security/advisories/GHSA-3g28-2vwg-gxq6 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Gogs | 0.15.0+dev (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |