CSRF Vulnerability in Gogs Open Source Git Service Affecting Team Management

CVE-2026-52800

What is CVE-2026-52800?

Gogs, an open-source self-hosted Git service, is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability that impacts the organization team member management functionality. Prior to version 0.14.3, an attacker could exploit this vulnerability by crafting a malicious link. If an organization owner, who is logged in, clicks this link, an unauthorized user could be added to the Owners team, granting the attacker equivalent privileges. This flaw poses a significant risk to organizational integrity and access control, but it has been addressed in the latest release, version 0.14.3.

References