Is CVE-2026-52810 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-52810 being exploited in the wild.

How severe is CVE-2026-52810?

High severity, with a CVSS score of 4, published 24 June 2026.

Which products and versions are affected?

gogs.io/gogs (Go) < 0.14.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3.

Is there a fix for CVE-2026-52810?

Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-52810 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-52810?

Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52810: Gogs improper access control in Git smart HTTP push authorization

Q: Which products and versions are affected?

gogs.io/gogs (Go) < 0.14.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3.

Q: Is there a fix for CVE-2026-52810?

Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-52810 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-52810?

Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-52810 · Severity: high · CVSS 4 · Published 2026-06-24

Gogs, a self-hosted Git service, contains a vulnerability where users with read-only access to a repository can bypass security controls to push unauthorized code changes. By manipulating the web request sent to the server, an attacker can trick the system into treating a write operation as a read operation. This could lead to unauthorized modification of source code, potentially allowing an attacker to inject malicious code into private projects.

Technologies: gogs.io/gogs (Go), Gogs. Vendors: Go, Gogs.

Quick answers

Is CVE-2026-52810 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-52810 being exploited in the wild.
How severe is CVE-2026-52810?: High severity, with a CVSS score of 4, published 24 June 2026.
Which products and versions are affected?: gogs.io/gogs (Go) < 0.14.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3.
Is there a fix for CVE-2026-52810?: Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52810 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-52810?: Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

gogs.io/gogs (Go): upgrade to 0.14.3 or later
```
go get gogs.io/gogs@v0.14.3
```

Technical details

An authorization bypass exists in Gogs' Git smart HTTP handler prior to version 0.14.3. The application determines the required permission level (read vs. write) based on the client-provided 'service' query parameter (e.g., ?service=git-upload-pack) rather than the actual RPC endpoint being requested (e.g., /git-receive-pack). An attacker with valid read-only credentials can send a POST request to the receive-pack endpoint while specifying a read-only service in the query string. The server incorrectly validates this as a read operation but proceeds to execute the write operation, allowing the attacker to push code to repositories where they should only have read access. This is fixed in version 0.14.3 by deriving the access mode from the routed action path.

Affected products

Gogs Gogs < 0.14.3

Identifiers

CVE-2026-52810
GHSA-wmfg-5p4h-5fw3
GO-2026-5712

Timeline

2026-06-07: patched: Fix merged in PR #8331 and released in v0.14.3
2026-06-19: advisory: GitHub Security Advisory GHSA-wmfg-5p4h-5fw3 published
2026-06-24: disclosed: CVE-2026-52810 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.