CVE-2026-52795: Gogs Auth Bypass Vulnerability

CVE-2026-52795 Overview

CVE-2026-52795 is an authorization flaw in Gogs, an open source self-hosted Git service. In version 0.14.3 and earlier, any authenticated user can watch a private repository they should not have access to. The repoWatchAction handler contains an inverted access check, returning a 404 when the user can read the repository rather than when they cannot. Once watching, the attacker's dashboard activity feed exposes commit messages, branch names, issue titles, and pull request details from the private repository. When email notifications are enabled, the attacker also receives emails containing issue and comment content. The flaw is classified under CWE-863: Incorrect Authorization.

Critical Impact
Authenticated attackers can subscribe to private Gogs repositories and exfiltrate commit, issue, and pull request content via dashboard feeds and email notifications.

Affected Products

Gogs self-hosted Git service version 0.14.3
Gogs self-hosted Git service prior to 0.14.3
Affected file: cmd/gogs/internal/web/webapi_repo.go

Discovery Timeline

2026-06-24 - CVE-2026-52795 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52795

Vulnerability Analysis

The vulnerability is an incorrect authorization defect in the Watch API endpoint of Gogs. The repoWatchAction function evaluates the wrong branch of a permission check. Instead of rejecting requests from users who cannot read a repository, it rejects requests from users who can read it. The result is that the watch action proceeds for users without read access.

Watching a repository subscribes the user to its activity stream. Gogs then surfaces commit metadata, branch updates, issue titles, and pull request descriptions on the watcher's dashboard. With email notifications enabled, full issue and comment content is delivered to the attacker's inbox. The attacker gains continuous, passive read access to sensitive repository data without invoking any code execution path.

Root Cause

The root cause is a single inverted boolean expression in the access check. The handler calls repoCtx.ViewerCanRead() to determine whether the requester has read permission. The missing logical negation causes the early-return guard to fire only for legitimate readers, allowing unauthorized users to pass through.

Attack Vector

An authenticated user sends a request to the Watch API for any private repository identifier on the target Gogs instance. The server processes the watch action without enforcing read permission. The attacker then monitors their personal dashboard feed and inbox to collect activity from the private repository. No privilege escalation, complex chaining, or user interaction is required.

// Security patch in cmd/gogs/internal/web/webapi_repo.go
// chore: fix up repoWatchAction inverted authz check
 func repoWatchAction(ctx context.Context, repoCtx *repoContext, watching bool) (statusCode int, resp *repoWatchResponse, err error) {
-	if repoCtx.ViewerCanRead() {
+	if !repoCtx.ViewerCanRead() {
 		return http.StatusNotFound, nil, errors.New("repository does not exist")
 	}

Source: Gogs commit d61caa3. The fix negates the predicate so the handler returns 404 when the viewer cannot read the repository.

Detection Methods for CVE-2026-52795

Indicators of Compromise

Watch records in the Gogs database linking users to repositories where those users have no team, collaborator, or organization membership.
Dashboard feed entries or outbound notification emails referencing private repositories that were not previously visible to the recipient.
Unexpected POST requests to Watch API endpoints (for example /api/v1/repos/{owner}/{repo}/subscription) from low-privilege accounts targeting private repositories.

Detection Strategies

Audit the watch table in the Gogs database and cross-reference watcher identities against repository access control lists. Flag any watcher who lacks read permission on a private repository.
Review web server access logs for successful (2xx) responses to Watch API calls against private repository paths from accounts that should not have visibility.
Correlate notification email delivery logs with repository permission state at the time of delivery.

Monitoring Recommendations

Enable verbose access logging on the Gogs HTTP layer and forward logs to a centralized analytics platform for anomaly detection.
Alert on watch list growth patterns where individual users subscribe to large numbers of repositories in short time windows.
Periodically reconcile watcher membership with current repository ACLs and revoke stale or unauthorized subscriptions.

How to Mitigate CVE-2026-52795

Immediate Actions Required

Upgrade Gogs to a version that includes commit d61caa3676fde060d0c03ccf815851dddc7c67e0 (post 0.14.3).
Audit existing watch subscriptions on all private repositories and remove entries belonging to users who lack current read access.
Rotate any secrets, tokens, or credentials that may have been disclosed in commits, issues, or comments of affected private repositories.

Patch Information

The Gogs maintainers fixed the inverted authorization check in commit d61caa3. Full details are documented in GitHub Security Advisory GHSA-v8w7-f6gc-cqc2. Administrators should pull the latest release containing the patch and rebuild or redeploy their Gogs instance.

Workarounds

Restrict Gogs registration and disable self-service account creation to limit the pool of authenticated users until the patch is applied.
Disable outbound email notifications in app.ini to prevent passive data exfiltration via inbox delivery while a fix is pending.
Place the Gogs instance behind a reverse proxy or VPN with strict access controls so only trusted users can reach the Watch API.

bash

# Example: disable email notifications in app.ini while patching is in progress
[mailer]
ENABLED = false

[service]
DISABLE_REGISTRATION = true
REQUIRE_SIGNIN_VIEW   = true