Executive brief
Gogs, a self-hosted Git service, contains a security flaw that allows unauthorized users to download private file attachments. By knowing or guessing a specific file identifier, an attacker can bypass security restrictions to access sensitive documents, credentials, or source code stored in private repositories. This could lead to the exposure of proprietary information or internal company data.
Technical details
A missing authorization vulnerability exists in the Gogs attachment download endpoint (`/attachments/:uuid`). The application retrieves attachment records solely by their UUID and serves the file without verifying if the requester has permissions for the parent repository, issue, or release. While unauthenticated access is most direct when `REQUIRE_SIGNIN_VIEW` is disabled, the flaw also allows any authenticated user to access attachments in repositories they are not authorized to view. Attackers can exploit this by discovering or brute-forcing attachment UUIDs to exfiltrate sensitive data. The issue is resolved in version 0.14.3.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-07: patched: Version 0.14.3 released
- 2026-06-19: advisory: GitHub Security Advisory published
- 2026-06-24: disclosed: CVE-2026-52799 published to NVD