CVE-2026-52808: Gogs API Vulnerability Allows Write-Level Collaborators to Modify Admin-Only Settings
Summary
CVE-2026-52808: Gogs's write-level collaborators can mutate admin-only repository settings via API. Affects gogs.io/gogs versions < 0.14.3. Fixed in 0.14.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Gogs is an open-source self-hosted Git service that provides a simple and efficient way to manage Git repositories. It offers features such as issue tracking, wikis, and repository mirroring. However, a significant vulnerability exists within its API that allows write-level collaborators to alter settings that should only be accessible to administrators, potentially compromising the integrity of the repository.
Vulnerability Detail
The vulnerability arises from three API endpoints (PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync) being protected by insufficient authorization checks. These endpoints are gated by reqRepoWriter() instead of the more secure reqRepoAdmin(), allowing users with write-level access to make unauthorized changes to repository settings. This can lead to serious consequences, such as redirecting users to malicious external sites or disabling essential features like the issue tracker and wiki. The vulnerability has a CVSS score of 7.1, indicating a high severity level.
How To Fix
Latest published version: v0.13.3 as of 22 Oct 2026
go get gogs.io/gogs@v0.13.3Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.14.3
This is the first release that contains the fix.
go get gogs.io/gogs@v0.14.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the API endpoints by implementing additional middleware checks in your application code. For example, you can modify the route registration in api.go to use reqRepoAdmin() instead of reqRepoWriter() for the affected endpoints:
m.Patch("/issue-tracker", reqRepoAdmin(), bind(editIssueTrackerRequest{}), issueTracker)
m.Patch("/wiki", reqRepoAdmin(), bind(editWikiRequest{}), wiki)
m.Post("/mirror-sync", reqRepoAdmin(), mirrorSync)
Conclusion
The vulnerability identified as CVE-2026-52808 in Gogs allows write-level collaborators to modify admin-only repository settings through insufficiently protected API endpoints. It is crucial to update to the patched version or implement workarounds to mitigate the risk of unauthorized changes.
See every vulnerability recorded for gogs.io/gogs →
FAQ
A write-level collaborator can change critical repository settings, redirecting users to malicious sites or disabling features like the issue tracker and wiki.
You can use Vulert's playground at Vulert Scanner to monitor and alert for open-source vulnerabilities in your software without requiring access to the code.
The CVSS score for this vulnerability is 7.1, indicating a high severity level.
Implement additional middleware checks in your application to restrict access to the affected API endpoints as a temporary workaround.
This vulnerability was discovered and reported by bugbunny.ai.
References
Related vulnerabilities
Recent vulnerabilities recorded for gogs.io/gogs.
