CVE-2026-52799: Gogs Auth Bypass Vulnerability

CVE-2026-52799 Overview

CVE-2026-52799 is a broken access control vulnerability in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 expose the GET /attachments/:uuid endpoint without verifying whether the requester has permission to view the associated Issue, Comment, Release, or repository. When REQUIRE_SIGNIN_VIEW is set to false, unauthenticated users can download attachments belonging to private repositories by referencing the attachment UUID directly. The flaw is categorized as Authorization Bypass through User-Controlled Key [CWE-639]. Gogs version 0.14.3 contains the fix.

Critical Impact
Unauthenticated attackers can retrieve attachments from private repositories, leading to disclosure of source code, credentials, or confidential documents stored as Issue, Comment, or Release attachments.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs instances with REQUIRE_SIGNIN_VIEW = false
Gogs deployments serving private repositories with attachments

Discovery Timeline

2026-06-24 - CVE-2026-52799 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52799

Vulnerability Analysis

The vulnerability resides in the Gogs attachment retrieval handler that serves files via the GET /attachments/:uuid route. The handler returns the raw attachment content when supplied with a valid UUID. The handler does not perform an authorization check against the parent resource that owns the attachment. Attachments belong to Issues, Comments, or Releases, each tied to a repository with its own visibility setting. Because the handler bypasses these visibility checks, any client that can reach the endpoint and present a UUID can download the file.

The Gogs project confirmed reproduction in a test environment where REQUIRE_SIGNIN_VIEW is disabled. In that configuration, the request requires no session cookie or token, making the disclosure path fully unauthenticated over the network.

Root Cause

The root cause is missing authorization logic in the attachment download handler. The code path validates the UUID format and locates the stored file, but it does not resolve the parent Issue, Comment, or Release to check whether the requesting user has read access to the owning repository. This is a classic Insecure Direct Object Reference pattern mapped to [CWE-639].

Attack Vector

An attacker who learns or guesses an attachment UUID issues a single HTTP GET request to /attachments/:uuid on the target Gogs server. UUIDs may be obtained from leaked logs, referrer headers, web archives, or through enumeration when UUIDs are not sufficiently random in older entries. The server returns the raw file regardless of repository visibility. No credentials, user interaction, or elevated privileges are required.

The vulnerability is described in the GitHub Security Advisory GHSA-p9f5-h3rx-j5qw and remediated in the GitHub Release v0.14.3.

Detection Methods for CVE-2026-52799

Indicators of Compromise

Unauthenticated GET /attachments/<uuid> requests in Gogs access logs returning HTTP 200 with binary content types
High volumes of requests to /attachments/ from a single source address, indicating UUID enumeration
Attachment downloads originating from IP addresses that have never authenticated to the Gogs instance

Detection Strategies

Parse Gogs HTTP access logs and correlate /attachments/:uuid requests against authenticated session identifiers to flag anonymous downloads from private repositories
Deploy a reverse proxy rule that logs the absence of session cookies on attachment endpoints and alerts when content is served
Compare attachment access patterns against repository visibility metadata to identify cross-tenant access

Monitoring Recommendations

Enable verbose access logging on the Gogs front-end web server and forward logs to a centralized SIEM for retention and analysis
Alert on bursts of sequential or randomized UUID requests to /attachments/ that exceed normal user behavior
Track outbound bandwidth on the Gogs host for unexpected spikes consistent with bulk attachment exfiltration

How to Mitigate CVE-2026-52799

Immediate Actions Required

Upgrade all Gogs instances to version 0.14.3 or later as published in the GitHub Release v0.14.3
Audit access logs for unauthenticated requests to /attachments/ since the deployment of any affected version
Rotate any secrets, tokens, or credentials that may have been stored in Issue, Comment, or Release attachments on private repositories

Patch Information

The Gogs maintainers fixed CVE-2026-52799 in release 0.14.3. The patch adds an authorization check that resolves each attachment to its parent Issue, Comment, or Release and verifies the requester holds read permission on the owning repository before returning file content. Administrators should consult the GitHub Security Advisory GHSA-p9f5-h3rx-j5qw for upgrade guidance.

Workarounds

Set REQUIRE_SIGNIN_VIEW = true in app.ini to force authentication on all view operations until the upgrade is applied
Restrict network access to the Gogs instance through a reverse proxy or VPN that enforces user authentication ahead of the application
Temporarily block the /attachments/ route at the reverse proxy for unauthenticated sessions if upgrading is not immediately possible

bash

# Configuration example: enforce sign-in for all view operations in app.ini
[service]
REQUIRE_SIGNIN_VIEW = true