Password Reset Vulnerability in Gogs Self-Hosted Git Service
CVE-2026-52809

6.8MEDIUM

Key Information:

Vendor

Gogs

Status
Gogs
Vendor
CVE Published:
24 June 2026

What is CVE-2026-52809?

Gogs, an open-source self-hosted Git service, contains a vulnerability where password-reset tokens are generated based on the wrong configuration parameter, leading to a longer-than-intended validity period. The flaw arises because the activation token lifetime is used instead of the reset password token lifetime, rendering the reset window ineffective. As a result, tokens can be exploited for the entire activation duration, posing a security risk. The issue has been addressed in version 0.14.3, which ensures proper enforcement of reset token lifetimes.

Affected Version(s)

gogs < 0.14.3

References

https://github.com/gogs/gogs/security/advisories/GHSA-5c3...
x_refsource_CONFIRM
https://github.com/gogs/gogs/releases/tag/v0.14.3
x_refsource_MISC

CVSS V3.1

Score:
6.8
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.