Is CVE-2026-25119 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-25119 being exploited in the wild.

How severe is CVE-2026-25119?

High severity, with a CVSS score of 4, published 24 June 2026.

Which products and versions are affected?

gogs.io/gogs (Go) <= 0.14.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3, <= 0.14.2.

Is there a fix for CVE-2026-25119?

Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-25119 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-25119?

Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25119: Gogs authentication bypass via spoofed reverse proxy headers

Q: Which products and versions are affected?

gogs.io/gogs (Go) <= 0.14.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3, <= 0.14.2.

Q: Is there a fix for CVE-2026-25119?

Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-25119 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-25119?

Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-25119 · Severity: high · CVSS 4 · Published 2026-06-24

Gogs, an open-source self-hosted Git service, contains a vulnerability that allows attackers to bypass login requirements. When a specific "reverse proxy authentication" setting is enabled, the system trusts identity information sent in web headers without verifying if they came from a legitimate security gateway. An attacker can exploit this to impersonate any user, including administrators, or automatically create new accounts, potentially leading to a full takeover of the Git service and its hosted source code.

Technologies: gogs.io/gogs (Go), Gogs. Vendors: Go, Gogs.

Quick answers

Is CVE-2026-25119 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-25119 being exploited in the wild.
How severe is CVE-2026-25119?: High severity, with a CVSS score of 4, published 24 June 2026.
Which products and versions are affected?: gogs.io/gogs (Go) <= 0.14.2, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3, <= 0.14.2.
Is there a fix for CVE-2026-25119?: Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-25119 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-25119?: Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gogs.io/gogs (Go): upgrade to 0.14.3 or later
```
go get gogs.io/gogs@v0.14.3
```

Technical details

Gogs prior to version 0.14.3 fails to validate the source of authentication headers when `ENABLE_REVERSE_PROXY_AUTHENTICATION` is active. The application reads the identity header (defaulting to `X-WEBAUTH-USER`) directly from the incoming HTTP request without verifying that the request originated from a trusted reverse proxy. A remote attacker can forge this header to bypass authentication entirely, impersonate any existing user (including admins), or trigger automatic account creation if `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION` is also enabled. The fix in version 0.14.3 introduces the `TRUSTED_PROXY_IPS` configuration option to restrict header acceptance to known, authorized IP addresses.

Affected products

Gogs Gogs < 0.14.3

Identifiers

CVE-2026-25119
GHSA-w6j9-vw59-27wv
GO-2026-5695

Timeline

2026-05-18: patched: Fix merged into main branch
2026-06-07: other: Release 0.14.3 published
2026-06-19: advisory: GitHub Security Advisory published
2026-06-24: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.