Executive brief
Gogs, a self-hosted Git service, contains a vulnerability where users with read-only access to a repository can bypass security controls to push unauthorized code changes. By manipulating the web request sent to the server, an attacker can trick the system into treating a write operation as a read operation. This could lead to unauthorized modification of source code, potentially allowing an attacker to inject malicious code into private projects.
Technical details
An authorization bypass exists in Gogs' Git smart HTTP handler prior to version 0.14.3. The application determines the required permission level (read vs. write) based on the client-provided 'service' query parameter (e.g., ?service=git-upload-pack) rather than the actual RPC endpoint being requested (e.g., /git-receive-pack). An attacker with valid read-only credentials can send a POST request to the receive-pack endpoint while specifying a read-only service in the query string. The server incorrectly validates this as a read operation but proceeds to execute the write operation, allowing the attacker to push code to repositories where they should only have read access. This is fixed in version 0.14.3 by deriving the access mode from the routed action path.
Affected products
- Gogs Gogs < 0.14.3
Timeline
- 2026-06-07: patched: Fix merged in PR #8331 and released in v0.14.3
- 2026-06-19: advisory: GitHub Security Advisory GHSA-wmfg-5p4h-5fw3 published
- 2026-06-24: disclosed: CVE-2026-52810 published to NVD