Authorization Bypass in Gogs Git Service Affecting Open Source Development

CVE-2026-52812

What is CVE-2026-52812?

The Gogs Git service has a vulnerability that allows unauthorized users with write access to one repository to link their repository to an object identifier (OID) owned by a private repository without proper validation of request body hashes. This issue originates from the way that Git LFS storage is handled, allowing for potential data exposure and unauthorized access to sensitive information. The issue is addressed in version 0.14.3, emphasizing the importance of keeping software up-to-date to mitigate such risks.

References