# CVE-2026-52810: Gogs improper access control in Git smart HTTP push authorization

Source: https://junglewise.ai/threats/cve-2026-52810-gogs-improper-access-control-in-git-smart-http-push-authorization  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-24. Updated: 2026-06-24  
License: CC BY 4.0 with a link back

CVE-2026-52810 · Severity: high · CVSS 4 · Published 2026-06-24

Gogs, a self-hosted Git service, contains a vulnerability where users with read-only access to a repository can bypass security controls to push unauthorized code changes. By manipulating the web request sent to the server, an attacker can trick the system into treating a write operation as a read operation. This could lead to unauthorized modification of source code, potentially allowing an attacker to inject malicious code into private projects.

Technologies: [gogs.io/gogs (Go)](https://junglewise.ai/threats/technologies/gogs-io-gogs), [Gogs](https://junglewise.ai/threats/technologies/gogs). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Gogs](https://junglewise.ai/threats/vendors/gogs).

## Quick answers

**Is CVE-2026-52810 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-52810 being exploited in the wild.

**How severe is CVE-2026-52810?** High severity, with a CVSS score of 4, published 24 June 2026.

**Which products and versions are affected?** gogs.io/gogs (Go) < 0.14.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3.

**Is there a fix for CVE-2026-52810?** Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-52810 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-52810?** Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- gogs.io/gogs (Go): upgrade to 0.14.3 or later

  ```sh
  go get gogs.io/gogs@v0.14.3
  ```


## Technical details

An authorization bypass exists in Gogs' Git smart HTTP handler prior to version 0.14.3. The application determines the required permission level (read vs. write) based on the client-provided 'service' query parameter (e.g., ?service=git-upload-pack) rather than the actual RPC endpoint being requested (e.g., /git-receive-pack). An attacker with valid read-only credentials can send a POST request to the receive-pack endpoint while specifying a read-only service in the query string. The server incorrectly validates this as a read operation but proceeds to execute the write operation, allowing the attacker to push code to repositories where they should only have read access. This is fixed in version 0.14.3 by deriving the access mode from the routed action path.

## Affected products

- Gogs Gogs < 0.14.3

## Identifiers

- CVE-2026-52810
- GHSA-wmfg-5p4h-5fw3
- GO-2026-5712

## Timeline

- 2026-06-07: patched: Fix merged in PR #8331 and released in v0.14.3
- 2026-06-19: advisory: GitHub Security Advisory GHSA-wmfg-5p4h-5fw3 published
- 2026-06-24: disclosed: CVE-2026-52810 published to NVD

## References

- [https://github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184](https://github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184)
- [https://github.com/gogs/gogs/pull/8331](https://github.com/gogs/gogs/pull/8331)
- [https://github.com/gogs/gogs/releases/tag/v0.14.3](https://github.com/gogs/gogs/releases/tag/v0.14.3)
- [https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3](https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3)

## Related threats

- [Gogs Git Smart HTTP authorization bypass](https://junglewise.ai/threats/cve-2026-123012-in-gogs-0-14-3-the-git-smart-http-authorization-layer-in)
- [Gogs open redirect via backslash normalization mismatch](https://junglewise.ai/threats/cve-2026-82402-gogs-is-an-open-source-self-hosted-git-service-prior-to-0-15-0)
- [GO-2026-5193 - Gogs: XSS in .ipynb files renderer due to outdated notebookjs in gogs.io/gogs](https://junglewise.ai/threats/go-2026-5193-gogs-xss-in-ipynb-files-renderer-due-to-outdated-d1e8727f)
- [Gogs stored XSS in Jupyter Notebook sanitizer endpoint](https://junglewise.ai/threats/cve-2026-52816-gogs-stored-xss-in-jupyter-notebook-sanitizer-endpoint)
- [Gogs unauthenticated information disclosure in organization teams API](https://junglewise.ai/threats/cve-2026-52815-gogs-unauthenticated-information-disclosure-in-organization-teams)