CVE-2026-52800: Gogs CSRF Vulnerability

CVE-2026-52800 Overview

CVE-2026-52800 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 allow organization team member management operations to be performed via HTTP GET requests without CSRF protection. An attacker can craft a malicious link that, when visited by an authenticated organization owner, silently adds an attacker-controlled account to the Owners team. The result is full organization owner privileges for the attacker. The issue is fixed in Gogs 0.14.3.

Critical Impact
A single crafted link clicked by an organization owner grants the attacker organization owner–equivalent privileges, including full control over repositories, members, and settings.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service deployments
Organizations and teams managed via the Gogs web interface

Discovery Timeline

2026-06-24 - CVE-2026-52800 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52800

Vulnerability Analysis

The vulnerability resides in the Gogs web router, where organization member and team management endpoints accept HTTP GET requests for state-changing actions. Because GET requests do not require a CSRF token and can be triggered cross-origin through simple resources such as <img> tags or redirects, any authenticated organization owner who visits attacker-controlled content can be coerced into executing privileged actions. The most impactful action is adding a user to the Owners team, which grants full administrative control over the organization.

Root Cause

The root cause is improper HTTP method restriction on sensitive endpoints. Routes such as /members/action/:action, /teams/:team/action/:action, and /teams/:team/action/repo/:action were registered to accept GET requests, bypassing the CSRF middleware that protects POST handlers. This violates the principle that state-changing operations must use unsafe HTTP methods with anti-CSRF tokens.

Attack Vector

Exploitation requires user interaction: an organization owner must be authenticated to the Gogs instance and must visit attacker-controlled content or click a crafted link. No prior privileges or credentials are required of the attacker. The fix enforces POST-only routing for organization member and team actions, ensuring CSRF token validation is applied.

// Patch in cmd/gogs/internal/web/web.go
// Source: https://github.com/gogs/gogs/commit/070df61ecd14c75b0aca93090f860b87ab17ac19

        m.Get("/dashboard", user.Dashboard)
        m.Get("/^:type(issues|pulls)$", user.Issues)
        m.Get("/members", org.Members)
-       m.Get("/members/action/:action", org.MembersAction)
+       m.Post("/members/action/:action", org.MembersAction)

        m.Get("/teams", org.Teams)
    }, context.OrgAssignment(true))

    m.Group("/:org", func() {
        m.Get("/teams/:team", org.TeamMembers)
        m.Get("/teams/:team/repositories", org.TeamRepositories)
-       m.Route("/teams/:team/action/:action", "GET,POST", org.TeamsAction)
-       m.Route("/teams/:team/action/repo/:action", "GET,POST", org.TeamsRepoAction)
+       m.Post("/teams/:team/action/:action", org.TeamsAction)
+       m.Post("/teams/:team/action/repo/:action", org.TeamsRepoAction)
    }, context.OrgAssignment(true, false, true))

The patch removes GET handlers from organization member and team action routes, enforcing POST and CSRF token validation.

Detection Methods for CVE-2026-52800

Indicators of Compromise

Unexpected additions to the Owners team of any organization, particularly accounts that were not provisioned by administrators.
Web server access logs showing GET requests to /org/:org/members/action/, /org/:org/teams/:team/action/, or /org/:org/teams/:team/action/repo/ paths.
Referer headers in access logs pointing to external or unfamiliar domains immediately preceding privileged team modifications.

Detection Strategies

Review Gogs audit and access logs for state-changing requests issued via GET to organization management routes.
Correlate team membership changes with authentication events to identify whether the change followed a legitimate admin session or a cross-site request.
Monitor for new outbound webhook configurations, deploy keys, or repository transfers performed shortly after an unexpected Owners team addition.

Monitoring Recommendations

Enable verbose request logging on the Gogs reverse proxy and forward logs to a centralized SIEM for retention and search.
Alert on any membership change to the Owners team of sensitive organizations.
Periodically reconcile organization owners against an authoritative roster maintained outside of Gogs.

How to Mitigate CVE-2026-52800

Immediate Actions Required

Upgrade all Gogs instances to version 0.14.3 or later as published in the GitHub Release v0.14.3.
Audit the Owners team membership of every organization and remove unauthorized accounts.
Rotate any access tokens, SSH keys, and webhooks associated with organizations whose ownership cannot be verified.

Patch Information

The vulnerability is fixed in Gogs 0.14.3. The fix is implemented in Pull Request 8321 and commit 070df61, which converts organization team and member action routes from GET to POST so that CSRF middleware enforces token validation. See the GHSA-pwx3-qcgw-vh7h advisory for full details.

Workarounds

Restrict access to the Gogs instance to trusted networks or VPN until the upgrade is applied.
Instruct organization owners to log out of Gogs when not actively administering the service, reducing the window in which a crafted link can trigger CSRF.
Deploy a reverse proxy rule that rejects GET requests to /org/*/members/action/* and /org/*/teams/*/action/* paths.

bash

# Example nginx rule to block GET requests to vulnerable action endpoints
location ~* ^/org/[^/]+/(members/action/|teams/[^/]+/action/) {
    if ($request_method = GET) {
        return 405;
    }
    proxy_pass http://gogs_backend;
}