CVE-2026-52815

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.

• CWE-200

• https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56
• https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56

Published

Jun 24, 2026

Last Modified

Jun 25, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5281Use after free in Dawn in Google Chrome prior to 146.0.7680.…8.8
• CVE-2026-52810Gogs is an open source self-hosted Git service. Prior to 0.1…7.1
• CVE-2026-52811Gogs is an open source self-hosted Git service. Prior to 0.1…9
• CVE-2026-52812Gogs is an open source self-hosted Git service. Prior to 0.1…7.1
• CVE-2026-52813Gogs is an open source self-hosted Git service. Prior to 0.1…10
• CVE-2026-52814Gogs is an open source self-hosted Git service. Prior to 0.1…5.5
• CVE-2026-52816Gogs is an open source self-hosted Git service. Prior to 0.1…5.4
• CVE-2026-5282Out of bounds read in WebCodecs in Google Chrome prior to 14…8.1
• CVE-2026-5283Inappropriate implementation in ANGLE in Google Chrome prior…6.5
• CVE-2026-52830fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1,…9.4
• CVE-2026-52837Easy!Appointments is a self hosted appointment scheduler. In…6.9
• CVE-2026-52838Easy!Appointments is a self hosted appointment scheduler. Ve…2.6