CVE-2026-52795: Gogs Authorization Bypass in Watch API Exposes Private Repository Metadata

Technical summary

CVE-2026-52795 is an authorization bypass in Gogs 0.14.3 and earlier affecting the Watch API endpoint. The vulnerability is a logical inversion in the repoCtx.ViewerCanRead() access control check. The handler evaluates the condition as `if repoCtx.ViewerCanRead()` when it should evaluate as `if !repoCtx.ViewerCanRead()`. This causes the API to deny access only to users who have legitimate read permissions, while allowing unauthorized users to successfully watch the repository. Once the watch relationship is established, the private repository's activity feed flows through the authenticated user's dashboard, exposing commit metadata, branch information, and issue/PR details. Email notification systems further amplify information leakage by delivering repository content to the attacker's inbox.

Business impact

This vulnerability enables credential-holding insiders or attackers with valid Gogs credentials to perform reconnaissance on private repositories without authorization. Organizations using Gogs for sensitive development work face unintended exposure of source code metadata, architectural decisions embedded in branch naming, and project status information visible in issue and PR titles. The risk is particularly acute for teams managing proprietary or security-critical code, as continuous exposure via dashboard feeds and email notifications could reveal release schedules, vulnerability fixes, or internal security practices. Reputational risk emerges if the surveillance is discovered, and the lack of audit trails for watch activity may prevent detection of the abuse.

Affected systems

Gogs 0.14.3 and all earlier versions contain this vulnerability. The defect lies in the Watch API authorization handler and affects any Gogs instance where authenticated users exist. There are no reported vendor patches in the provided data; however, users should consult the official Gogs repository and security advisories to verify the status of patched versions beyond 0.14.3.

Exploitability

This vulnerability requires an authenticated user account on the Gogs instance—the attacker cannot exploit it without valid credentials. However, once authenticated, the exploit is trivial: a single API call to watch a private repository succeeds due to the inverted logic. The attack surface is the Watch API endpoint, accessible to any authenticated user. The CVSS score of 4.3 (MEDIUM) reflects the requirement for prior authentication and the confidentiality-only impact; no code execution, data modification, or denial of service is possible. The vulnerability is not listed in the CISA KEV catalog, indicating it has not yet been observed in active exploitation at scale.

Remediation

The fix requires correcting the inverted boolean logic in the Watch API handler. Developers must change the access control condition from `if repoCtx.ViewerCanRead()` to `if !repoCtx.ViewerCanRead()` to properly deny watch operations for users lacking read access. Organizations should upgrade to a patched version once available. As an interim control, if possible, disable the Watch API or restrict it to read-only staff until a patch is validated and deployed. Audit existing watch relationships on private repositories to identify unauthorized watchers.

Patch guidance

Monitor the official Gogs GitHub repository and security announcements for a patch version addressing this authorization bypass. Test patches in a non-production environment before rollout. The fix is expected to be straightforward (a logic inversion), so patched versions should be stable. Verify the patch version number against the official Gogs advisory before deployment. Consider using configuration management to automate rollout across multiple Gogs instances in your environment.

Detection guidance

Review audit logs or API access logs for Watch API calls (`/api/v1/repos/{owner}/{repo}/subscription` or similar endpoints depending on Gogs version) originating from users who lack read permissions to the target repositories. Examine watch relationships on private repositories to identify watchers without documented authorization. If email notifications are enabled, correlate email delivery logs with watch events to flag suspicious notification flows. Implement alerting on watch operations against private repositories, particularly if the watcher has never accessed the repository via other means (commits, comments, issue creation).

Why prioritize this

Although the CVSS score is MEDIUM (4.3) and no active exploitation is reported in KEV, this vulnerability merits prompt attention for organizations hosting sensitive code on Gogs. The inverted logic is a critical correctness bug that was likely overlooked in code review, raising questions about the maturity of access control testing in the project. The information disclosure is passive but continuous—the attacker gains persistent, ongoing access to sensitive metadata every time they check their dashboard or read emails. For teams managing proprietary algorithms, security research, or infrastructure code, this represents a material confidentiality risk. Prioritize patching if your Gogs instance contains private repositories with sensitive content or if you operate in a regulated industry with strict access control requirements.

Risk score, explained

The CVSS 3.1 score of 4.3 reflects a Low Attack Complexity, no User Interaction requirement, and single-factor authentication (PR:L). The Confidentiality impact is Low because the exposed information is repository metadata rather than the actual code files; however, metadata alone (commit messages, branch names, issue titles) can reveal significant business intelligence. The score does not increase to High because an authenticated user account is a prerequisite, creating a friction point that reduces the attack surface compared to unauthenticated exploits. For organizations where internal user accounts are tightly controlled or where credential compromise is actively monitored, the practical risk may be lower than the base score suggests.

Frequently asked questions