CVE-2026-52808: Gogs API Authorization Bypass—Write-Level Privilege Escalation

Technical summary

Three Gogs API endpoints—PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync—enforce write-level access control (reqRepoWriter) rather than admin-level control (reqRepoAdmin). This creates a privilege escalation vector where a user with AccessMode == AccessModeWrite (strictly less than AccessModeAdmin) can invoke these endpoints to: (1) disable the native issue tracker or wiki, (2) set external tracker or wiki URLs pointing to attacker-controlled services, or (3) trigger mirror synchronization. These same operations are correctly gated behind admin-level checks in the web UI, indicating an inconsistency in how the security model is applied across interface layers.

Business impact

An attacker with write-level repository access (common in development teams) can sabotage repository workflow by disabling issue tracking or wiki documentation. More significantly, they can redirect repository visitors to attacker-controlled issue trackers or wiki mirrors, enabling phishing attacks, credential harvesting, or malware distribution without requiring admin approval. Mirror sync tampering could poison upstream/downstream repository copies. For organizations relying on Gogs for internal Git hosting, this creates insider-threat and supply-chain contamination risks, particularly when repositories are shared across teams or external contributors have write access.

Affected systems

Gogs versions prior to 0.14.3 are affected. The vulnerability requires network access to the Gogs API and valid repository write credentials, limiting exposure to authenticated users. Organizations running Gogs as a self-hosted service are affected if they permit write-level collaborators on repositories. Open-source projects using Gogs that accept external pull request collaborators are at higher risk, as are internal development platforms where contractor or junior developer write access is common.

Exploitability

Exploitability is moderate-to-high. An attacker must possess valid write-level credentials for a target repository (PR:L in the CVSS vector), but no user interaction is required once authenticated. The attack surface is three distinct API endpoints, each of which can inflict different damage. No advanced exploitation techniques are needed—straightforward API calls with attacker-supplied payloads will succeed. The barrier to discovery is low, as the API endpoints are documented and accessible to any authenticated user who inspects API traffic or Gogs source code. However, the attacker's identity and actions are logged, making attribution easier than external exploitation.

Remediation

Upgrade Gogs to version 0.14.3 or later, which corrects the authorization logic to require admin-level permissions for all three affected endpoints. Organizations unable to upgrade immediately should implement network-level controls: restrict direct API access to trusted IP ranges, disable the affected endpoints via reverse proxy rules, or reduce write-level collaborator privileges to read-only until patching is complete. Audit repositories for evidence of unauthorized feature disabling or URL modification, particularly on public or shared repositories.

Patch guidance

Upgrade Gogs to version 0.14.3 or later. Before upgrading, verify that your instance is running a vulnerable version (0.14.2 or earlier) and back up your Gogs database and configuration. The patch modifies authorization checks in the API layer to enforce AccessModeAdmin requirements on the three vulnerable endpoints. Test the upgrade in a staging environment if possible to confirm compatibility with your repository configuration. Post-upgrade, audit recent API logs for suspicious calls to these endpoints from write-level users.

Detection guidance

Monitor Gogs API access logs for calls to the three vulnerable endpoints from accounts with write-level but not admin-level permissions. Look for PATCH requests to issue-tracker or wiki endpoints, and POST requests to mirror-sync, especially if they originate from unexpected IP addresses or during off-hours. Check repositories for anomalous state changes: disabled issue trackers, unexpected external tracker/wiki URLs, or unusual mirror sync activity. Inspect git logs for changes to .gitmodules or mirror configuration files that correlate with suspicious API calls.

Why prioritize this

This vulnerability merits urgent patching due to its HIGH CVSS score (7.1), low authentication barrier (write-level, not admin), and multi-faceted impact on repository integrity and user safety. The ability to inject malicious URLs that compromise visiting users elevates risk beyond internal repository sabotage. Organizations with public or shared repositories, or those that distribute Gogs to customers, face reputational and supply-chain consequences. The fix is non-breaking and straightforward, making delay unjustifiable.

Risk score, explained

CVSS 7.1 reflects: (1) network-accessible API (AV:N), no special conditions required to trigger the vulnerability (AC:L), low authentication requirement (PR:L—write access only, not admin), no user interaction needed (UI:N), and impact scoped to the single affected system (S:U). Integrity impact is marked HIGH because attackers can disable features and inject URLs, directly corrupting repository state and user experience. Availability is marked LOW because while features can be disabled, the core Git functionality remains operational. Confidentiality is unaffected.

Frequently asked questions