Executive brief
Gogs, an open-source self-hosted Git service, contains a vulnerability that allows attackers to bypass login requirements. When a specific "reverse proxy authentication" setting is enabled, the system trusts identity information sent in web headers without verifying if they came from a legitimate security gateway. An attacker can exploit this to impersonate any user, including administrators, or automatically create new accounts, potentially leading to a full takeover of the Git service and its hosted source code.
Technical details
Gogs prior to version 0.14.3 fails to validate the source of authentication headers when `ENABLE_REVERSE_PROXY_AUTHENTICATION` is active. The application reads the identity header (defaulting to `X-WEBAUTH-USER`) directly from the incoming HTTP request without verifying that the request originated from a trusted reverse proxy. A remote attacker can forge this header to bypass authentication entirely, impersonate any existing user (including admins), or trigger automatic account creation if `ENABLE_REVERSE_PROXY_AUTO_REGISTRATION` is also enabled. The fix in version 0.14.3 introduces the `TRUSTED_PROXY_IPS` configuration option to restrict header acceptance to known, authorized IP addresses.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-05-18: patched: Fix merged into main branch
- 2026-06-07: other: Release 0.14.3 published
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD