CVSS 3.1
7.1 highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:LCVE-2026-52808
High (7.1). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in gogs.io/gogs 0.14.3.
Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync — are gated by reqRepoWriter() rather than reqRepoAdmin(). The equivalent operations in the web UI sit behind reqRepoAdmin, which requires AccessMode >= AccessModeAdmin. A write-level collaborator (who has AccessMode == AccessModeWrite < AccessModeAdmin) can therefore call these API endpoints directly to disable the native issue tracker or wiki, inject attacker-controlled external tracker/wiki URLs that redirect all repository visitors, or trigger mirror sync — none of which they are authorized to do. This vulnerability is fixed in 0.14.3.
Severity
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-31)
- CWEs
- CWE-269, CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-268j-37xf-pp52 | Go | gogs.io/gogs | <0.14.3 | 0.14.3 |
| GO-2026-5065 | Go | gogs.io/gogs | all versions | no fix published |