Unauthorized Push Vulnerability in Gogs Git Service
CVE-2026-52810
7.1HIGH
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-52810?
Gogs, an open-source self-hosted Git service, is susceptible to an improper authorization vulnerability. Prior to version 0.14.3, the service's handling of Git smart HTTP requests permitted unauthorized users to perform push operations using the client-supplied service query string. This weakness allows actions that should be restricted to read access, thus jeopardizing the integrity of repository security. The vulnerability has been addressed in version 0.14.3, which ensures proper authorization checks for push requests.
Affected Version(s)
gogs < 0.14.3
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.