Executive brief
Gogs is an open-source self-hosted Git service used by developers to manage source code. A security flaw allows any registered user to "watch" private repositories they do not have permission to access. Once watching, the unauthorized user can see sensitive information such as commit messages, branch names, and issue titles through their activity feed or email notifications, potentially exposing proprietary development details and internal project data.
Technical details
An incorrect authorization check (CWE-863) exists in the `repoWatchAction` function within `cmd/gogs/internal/web/webapi_repo.go`. The logic incorrectly returns a 404 error when a user *has* read access (`repoCtx.ViewerCanRead()`) instead of when they *lack* it (`!repoCtx.ViewerCanRead()`). An authenticated attacker can exploit this by sending a POST request to the Watch API for a private repository they do not own. Once subscribed, the system's `notifyWatchers()` and `retrieveFeeds()` functions propagate private repository metadata (commit messages, branch names, issue/PR titles) to the attacker's dashboard and email. The vulnerability is addressed in version 0.15.0+dev.
Affected products
- Gogs Gogs <= 0.14.3
Timeline
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE published to NVD