Unauthenticated Information Disclosure in Gogs Git Service

CVE-2026-52815

What is CVE-2026-52815?

Gogs, an open-source self-hosted Git service, is susceptible to an unauthenticated information disclosure vulnerability affecting versions prior to 0.14.3. The flaw allows any unauthenticated user to access sensitive information through the GET /api/v1/orgs/:orgname/teams endpoint, which reveals team IDs, names, descriptions, and permission levels without the need for authentication. This exposes organizations to unauthorized access and potential exploitation of sensitive data by malicious actors. The issue has been addressed in version 0.14.3, which incorporates proper authentication checks to safeguard team information.

References