Unauthorized Modification in Gogs Git Service Affects Users

CVE-2026-23632

What is CVE-2026-23632?

Gogs, a self-hosted Git service, suffers from an authorization bypass vulnerability in versions 0.13.3 and earlier. Specifically, the 'PUT /repos/:owner/:repo/contents/*' endpoint fails to enforce write permissions correctly, permitting users with only read permissions to modify repository contents. By exploiting this flaw, an attacker with read access can alter files and commit changes, leveraging a token with insufficient permissions. This critical oversight puts sensitive data and project integrity at risk. The vulnerability is mitigated in versions 0.13.4 and 0.14.0+dev, which include necessary permissions checks to prevent unauthorized modifications.

References