CVE-2026-52812: Gogs Git LFS cross-repository disclosure via insufficient OID verification

CVE-2026-52812 · Severity: high · CVSS 4 · Published 2026-06-24

Gogs is an open-source self-hosted Git service. A security flaw in how the service handles large files (Git LFS) allows a user with write access to any repository to gain unauthorized access to private files in other repositories. By claiming to upload a file that already exists in a private repository, an attacker can trick the system into giving them a copy of that file, potentially leading to the exposure of sensitive intellectual property or secrets.

Technologies: gogs.io/gogs (Go), Gogs. Vendors: Go, Gogs.

Quick answers

Is CVE-2026-52812 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-52812 being exploited in the wild.
How severe is CVE-2026-52812?
High severity, with a CVSS score of 4, published 24 June 2026.
Which products and versions are affected?
gogs.io/gogs (Go) < 0.14.3, SEMVER:introduced=0, SEMVER:introduced=0,fixed=0.14.3; Gogs < 0.14.3, >= 0.12.0, < 0.14.3.
Is there a fix for CVE-2026-52812?
Yes. gogs.io/gogs (Go): upgrade to 0.14.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-52812 attacked?
It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-52812?
Check whether you run gogs.io/gogs (Go) or Gogs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • gogs.io/gogs (Go): upgrade to 0.14.3 or later
    go get gogs.io/gogs@v0.14.3

Technical details

Gogs uses content-addressed storage for Git LFS objects, where files are stored based on their OID (hash). Prior to version 0.14.3, the 'serveUpload' function implemented a deduplication shortcut: if an OID already existed on disk, the server would skip the upload and create a new database entry linking the current repository to that OID without verifying that the uploaded data actually matched the OID. An attacker with write access to any repository can exploit this by initiating an LFS upload for a known OID belonging to a private repository. Because the server fails to validate the request body against the OID during this 'dedupe' path, the attacker can establish a valid authorization link to the private object and subsequently download it through their own repository's LFS endpoint. This has been fixed in version 0.14.3 by enforcing hash verification on all upload paths.

Affected products

  • Gogs Gogs < 0.14.3

Identifiers

  • CVE-2026-52812
  • GHSA-6p9m-q3jp-47h4
  • GO-2026-5184

Timeline

  • 2026-06-07: patched: Fixed in version 0.14.3
  • 2026-06-24: disclosed: CVE-2026-52812 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.