CVE-2026-52799: Gogs Attachment Authorization Bypass – Unauthenticated Private Repository Access

Technical summary

The GET /attachments/:uuid endpoint in Gogs fails to enforce access control before returning raw attachment content. The vulnerability combines missing authorization checks (CWE-862) with improper access restriction (CWE-639). An attacker can enumerate or predict attachment UUIDs and retrieve files without authentication, particularly in deployments with REQUIRE_SIGNIN_VIEW disabled. The lack of permission verification means attachments tied to private repository issues, pull request comments, or release notes become accessible to any network-adjacent attacker.

Business impact

Organizations running Gogs as a private code repository risk exposure of sensitive artifacts, design documents, credentials, or proprietary code fragments embedded in issue attachments or release notes. The compromise is especially severe for small teams or internal development environments that assume self-hosted Git services enforce repository privacy by default. An attacker gains reconnaissance data and potentially operational secrets without leaving authentication logs.

Affected systems

Gogs versions prior to 0.14.3 are affected. Deployments are vulnerable if they use self-hosted instances with the GET /attachments endpoint exposed to network requests. The risk is highest in environments configured with REQUIRE_SIGNIN_VIEW = false, though even standard setups with authentication disabled for certain operations remain exposed. This affects Gogs installations across all deployment models (Docker, binary, source).

Exploitability

Exploitation requires no authentication, no user interaction, and minimal complexity. An attacker needs only network access to the Gogs instance and knowledge of or ability to discover attachment UUIDs. The barrier to exploitation is low; UUID enumeration or prediction may be feasible depending on UUID generation practices. The CVSS 7.5 (HIGH) score reflects the ease of remote exploitation and the confidentiality impact, absent any network segmentation or rate-limiting controls.

Remediation

Upgrade to Gogs 0.14.3 or later. The fix implements authorization checks that verify the requester's access to the parent Issue, Comment, Release, or repository before serving attachments. Organizations should verify their current Gogs version and apply the patch immediately. For instances that cannot upgrade immediately, restrict network access to the Gogs instance and enable REQUIRE_SIGNIN_VIEW to enforce authentication for all operations.

Patch guidance

Verify your current Gogs installation version using the admin panel or by checking the binary/release notes. Download version 0.14.3 or the latest stable release from the official Gogs repository. Apply the patch following Gogs deployment documentation (binary update, Docker image pull, or source rebuild as applicable). Restart the Gogs service and confirm the version change in the admin interface. No data migration is required; the fix is a pure code update.

Detection guidance

Monitor for unusual requests to GET /attachments/ endpoints, especially patterns indicating UUID enumeration (rapid sequential requests with different UUID values). Log and alert on successful attachment downloads from unauthenticated sessions or sessions lacking repository access. Audit attachment download logs to identify whether private repository attachments were accessed during the vulnerable period. Network-level detection is challenging without verbose logging; prioritize log analysis on affected Gogs instances.

Why prioritize this

While not yet listed on the KEV catalog, this vulnerability presents moderate urgency due to its high CVSS score (7.5) and ease of exploitation. Self-hosted Git repositories are common attack targets for reconnaissance and data theft. Organizations should prioritize patching to close this low-barrier path to private repository disclosure. The lack of KEV status does not diminish the practical risk in environments where Gogs serves sensitive code or documentation.

Risk score, explained

CVSS 3.1 score of 7.5 reflects HIGH severity: Network-accessible endpoint (AV:N), low attack complexity (AC:L), no privilege or user interaction required (PR:N/UI:N), and high confidentiality impact (C:H). No integrity or availability impact, hence the C:H/I:N/A:N profile. The score appropriately captures the risk of unauthorized file disclosure without overstating the threat (confidentiality only).

Frequently asked questions