CVE-2026-52808

Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync — are gated by reqRepoWriter() rather than reqRepoAdmin(). The equivalent operations in the web UI sit behind reqRepoAdmin, which requires AccessMode >= AccessModeAdmin. A write-level collaborator (who has AccessMode == AccessModeWrite < AccessModeAdmin) can therefore call these API endpoints directly to disable the native issue tracker or wiki, inject attacker-controlled external tracker/wiki URLs that redirect all repository visitors, or trigger mirror sync — none of which they are authorized to do. This vulnerability is fixed in 0.14.3.

• CWE-269
• CWE-863

• https://github.com/gogs/gogs/commit/6283462119bd8894f1599d70339b5e823f99954a
• https://github.com/gogs/gogs/pull/8327
• https://github.com/gogs/gogs/releases/tag/v0.14.3
• https://github.com/gogs/gogs/security/advisories/GHSA-268j-37xf-pp52
• https://github.com/gogs/gogs/security/advisories/GHSA-268j-37xf-pp52

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-52801Gogs is an open source self-hosted Git service. Prior to 0.1…8.1
• CVE-2026-52802Gogs is an open source self-hosted Git service. Prior to 0.1…5.4
• CVE-2026-52804Gogs is an open source self-hosted Git service. Prior to 0.1…5.5
• CVE-2026-52805Gogs is an open source self-hosted Git service. Prior to 0.1…8.7
• CVE-2026-52806Gogs is an open source self-hosted Git service. Prior to 0.1…9.9
• CVE-2026-52807Gogs is an open source self-hosted Git service. Prior to 0.1…4.8
• CVE-2026-52809Gogs is an open source self-hosted Git service. Prior to 0.1…6.8
• CVE-2026-5281Use after free in Dawn in Google Chrome prior to 146.0.7680.…8.8
• CVE-2026-52810Gogs is an open source self-hosted Git service. Prior to 0.1…7.1
• CVE-2026-52811Gogs is an open source self-hosted Git service. Prior to 0.1…9
• CVE-2026-52812Gogs is an open source self-hosted Git service. Prior to 0.1…7.1
• CVE-2026-52813Gogs is an open source self-hosted Git service. Prior to 0.1…10