CVE-2026-23632: Gogs Auth Bypass Vulnerability

CVE-2026-23632 Overview

CVE-2026-23632 is an Authorization Bypass vulnerability affecting Gogs, an open source self-hosted Git service. The vulnerability exists in version 0.13.3 and prior, where the endpoint PUT /repos/:owner/:repo/contents/* fails to properly enforce write permissions, allowing users with read-only access tokens to modify repository contents.

Critical Impact

Attackers with read-only repository access can bypass authorization controls to create commits and push changes to repositories, potentially introducing malicious code or corrupting project integrity.

Affected Products

• Gogs version 0.13.3 and prior versions
• Self-hosted Git service installations using vulnerable Gogs versions
• Deployments relying on read-only tokens for repository access control

Discovery Timeline

• February 6, 2026 - CVE CVE-2026-23632 published to NVD
• February 6, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23632

Vulnerability Analysis

This vulnerability is classified under CWE-862 (Missing Authorization), a weakness category that occurs when a software component fails to perform authorization checks for a critical resource or operation. In Gogs, the flawed implementation allows authenticated users to bypass intended access restrictions and perform privileged operations beyond their granted permissions.

The vulnerability enables read-only token holders to write to repositories they should only be able to read. This represents a significant breach of the principle of least privilege and undermines the entire permission model that organizations rely on to protect their source code repositories.

Root Cause

The root cause of CVE-2026-23632 lies in the repoAssignment() function's permission validation logic for the contents API endpoint. The PUT /repos/:owner/:repo/contents/* endpoint incorrectly accepts requests authenticated with read-only permissions instead of requiring write permissions.

When processing the PUT request, the permission check in repoAssignment() passes with read-level access. The subsequent call to PutContents() then invokes UpdateRepoFile(), which creates commits and executes git push operations without any secondary authorization verification.

Attack Vector

The attack vector for this vulnerability operates over the network and requires low privileges (a valid read-only access token). An attacker who has obtained a read-only repository token—whether through legitimate means or credential theft—can exploit this vulnerability to:

1. Send a crafted PUT request to the vulnerable endpoint
2. Bypass the permission check with their read-only token
3. Execute UpdateRepoFile() to create unauthorized commits
4. Push malicious changes to the repository

The vulnerability can be exploited to modify files in the targeted repository, potentially introducing backdoors, malicious dependencies, or corrupted code. Since the attack uses a legitimate token, the malicious commits may be attributed to the token owner, complicating forensic investigation.

For detailed technical information, refer to the GitHub Security Advisory.

Detection Methods for CVE-2026-23632

Indicators of Compromise

• Unexpected commits or file modifications in repositories by users with read-only permissions
• API access logs showing PUT requests to /repos/:owner/:repo/contents/* endpoints from read-only tokens
• Git push operations originating from accounts that should not have write access
• Unauthorized modifications to sensitive files like CI/CD configurations or build scripts

Detection Strategies

• Monitor Gogs API logs for PUT requests to the contents endpoint and correlate with token permission levels
• Implement Git hook scripts to validate committer permissions before accepting pushes
• Deploy file integrity monitoring on critical repository files
• Review access token usage patterns for anomalous write operations from read-only tokens

Monitoring Recommendations

• Enable detailed API request logging in Gogs to capture endpoint access and authentication details
• Configure alerting for repository modifications outside of normal development workflows
• Audit all active access tokens and verify their permission levels match intended use cases
• Implement real-time monitoring of Git push events with permission validation

How to Mitigate CVE-2026-23632

Immediate Actions Required

• Upgrade Gogs to version 0.13.4 or 0.14.0+dev immediately
• Audit all repository modifications made since deploying vulnerable Gogs versions
• Revoke and regenerate all access tokens to ensure permission levels are correctly enforced
• Review Git commit history for suspicious or unauthorized changes

Patch Information

The Gogs development team has addressed this vulnerability in versions 0.13.4 and 0.14.0+dev. The patch corrects the permission validation in repoAssignment() to properly require write permissions for the PUT /repos/:owner/:repo/contents/* endpoint.

Organizations should upgrade to the patched versions as soon as possible. For additional details, consult the GitHub Security Advisory.

Workarounds

• Restrict network access to the Gogs API to trusted IP addresses until patching is complete
• Disable or remove read-only access tokens temporarily if write access is not required
• Implement additional authorization controls at the reverse proxy or API gateway level
• Monitor and alert on all PUT requests to the contents API endpoint

# Configuration example
# Restrict access to Gogs API via nginx reverse proxy
# Add to nginx server block for Gogs

location ~ ^/api/v1/repos/.*/contents {
    # Temporarily block PUT requests to the vulnerable endpoint
    if ($request_method = PUT) {
        return 403;
    }
    proxy_pass http://gogs_backend;
}