Git Smart HTTP Authorization Flaw in Gogs Affects Access Control

CVE-2026-123012

What is CVE-2026-123012?

In Gogs version 0.14.3, a significant vulnerability exists within the Git Smart HTTP authorization layer, allowing users to execute pushes even when their access is limited to read permissions. This flaw arises from a case sensitivity issue in the verification process of the HTTP method verb, leading to unintended escalations of access rights. This situation poses a risk of unauthorized changes to repositories, undermining the integrity of source control mechanisms. It is essential for users and administrators of Gogs to be aware of this issue and take necessary precautions.

References