CVE-2026-52801: Gogs Auth Bypass Vulnerability

CVE-2026-52801 Overview

CVE-2026-52801 is an improper input validation vulnerability [CWE-20] in Gogs, an open source self-hosted Git service. The flaw exists in the Mirror Settings functionality, which provided an alternative path that bypassed the validation controls present in the New Migration workflow. Any authenticated user could leverage this gap to import local repositories on the server, exposing sensitive content stored on the host filesystem. The SaveAddress function failed to validate remote addresses supplied when updating a mirror, enabling abuse of local path references. The vulnerability affects Gogs versions prior to 0.14.3 and is fixed in release 0.14.3.

Critical Impact
An authenticated attacker can read arbitrary local repositories from the Gogs host by submitting a crafted mirror address, leading to confidentiality loss and potential service disruption.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service deployments
Gogs instances with mirror functionality enabled for authenticated users

Discovery Timeline

2026-06-24 - CVE-2026-52801 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52801

Vulnerability Analysis

Gogs exposes two paths for configuring repository sources: the New Migration workflow and the Mirror Settings page. The New Migration flow invokes ParseRemoteAddr, which enforces permission checks when the supplied address is a local filesystem path. The Mirror Settings update flow, handled by the SaveAddress function, omitted this validation entirely. An authenticated user could submit a mirror address pointing to a local path on the Gogs server, such as another tenant's repository directory or a sensitive system path containing a Git repository. The server would then mirror that content into a repository the attacker controls, exposing contents that the user lacks permission to access.

Root Cause

The root cause is missing input validation [CWE-20] on the remote address field in the mirror update handler. The original ParseRemoteAddr was tied to the MigrateRepo form struct and was not invoked when mirror addresses were updated through other code paths, leaving local path references unchecked.

Attack Vector

Exploitation requires network access and a valid Gogs account. The attacker creates or owns a repository, navigates to its mirror settings, and submits a local filesystem path as the mirror address. No user interaction from a victim is required. The scope is limited to data accessible from the Gogs process account.

// Security patch in internal/form/repo.go
// Source: https://github.com/gogs/gogs/commit/11e19f28b5c82466fd1689c94344ef4313ee986c

+type ParseRemoteAddrOptions struct {
+	CloneAddr    string
+	User         *database.User
+	AuthUsername string
+	AuthPassword string
+}
+
 // ParseRemoteAddr checks if given remote address is valid,
 // and returns composed URL with needed username and password.
 // It also checks if given user has permission when remote address
 // is actually a local path.
-func (f MigrateRepo) ParseRemoteAddr(user *database.User) (string, error) {
-	remoteAddr := strings.TrimSpace(f.CloneAddr)
+func ParseRemoteAddr(options ParseRemoteAddrOptions) (string, error) {
+	remoteAddr := strings.TrimSpace(options.CloneAddr)
 
 	// Remote address can be HTTP/HTTPS/Git URL or local path.
 	if strings.HasPrefix(remoteAddr, "http://") ||

The patch refactors ParseRemoteAddr into a standalone function accepting ParseRemoteAddrOptions, allowing the mirror update handler to invoke the same validation that the migration flow uses. See the GitHub Security Advisory GHSA-wv27-2vqp-j7g5 for the full advisory.

Detection Methods for CVE-2026-52801

Indicators of Compromise

Mirror repository entries containing local filesystem paths such as /, /home/, /var/, or /etc/ in the mirror_address column of the Gogs database.
Unexpected repository content matching system files or other users' repositories present on the host.
Repository creation followed by rapid mirror address modification by non-administrative accounts.

Detection Strategies

Audit the Gogs database mirror table for any addresses that resolve to local filesystem paths rather than HTTP, HTTPS, Git, or SSH URLs.
Review Gogs application logs for mirror update requests to the /repo/settings endpoint with non-URL mirror_address values.
Correlate repository creation events with subsequent mirror configuration changes to identify suspicious behavior patterns.

Monitoring Recommendations

Enable verbose request logging on the reverse proxy in front of Gogs and alert on POST requests to mirror settings endpoints from low-privileged accounts.
Monitor disk read patterns from the Gogs process for accesses outside its configured repository.ROOT directory.
Track authenticated user activity for anomalous repository creation rates combined with mirror configuration changes.

How to Mitigate CVE-2026-52801

Immediate Actions Required

Upgrade Gogs to version 0.14.3 or later, which contains the validation fix from pull request #8225.
Audit all existing mirror repositories for local path references and remove any that were not configured by administrators.
Restrict new user registration until the upgrade is completed if the instance is publicly reachable.

Patch Information

The fix is delivered in Gogs release v0.14.3 and tracked in pull request #8225. The corrective commit 11e19f28b5c82466fd1689c94344ef4313ee986c refactors ParseRemoteAddr so that the mirror update path validates remote addresses using the same logic as the migration flow.

Workarounds

Disable self-service user registration and limit accounts to trusted operators until the patch is applied.
Run the Gogs process under a dedicated low-privilege account whose filesystem access is limited to the Gogs repository.ROOT directory.
Place Gogs behind a reverse proxy that blocks POST requests to mirror settings endpoints from non-administrative users as a temporary control.

bash

# Verify the running Gogs version contains the fix
gogs --version
# Expected output: Gogs version 0.14.3 or later

# Audit mirror table for local path references (SQLite example)
sqlite3 /path/to/gogs.db "SELECT repo_id, address FROM mirror WHERE address NOT LIKE 'http%' AND address NOT LIKE 'git@%' AND address NOT LIKE 'ssh://%';"