CVE-2026-52808: Gogs Authentication Bypass Vulnerability

CVE-2026-52808 Overview

CVE-2026-52808 is a privilege escalation vulnerability in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 apply the wrong authorization middleware to three repository administration API endpoints. The endpoints PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync are guarded by reqRepoWriter() instead of reqRepoAdmin(). The equivalent operations in the web interface require AccessModeAdmin. A collaborator with write-level access can therefore invoke administrator-only operations through the REST API. The flaw is tracked under CWE-269: Improper Privilege Management and fixed in Gogs 0.14.3.

Critical Impact
Write-level collaborators can disable issue trackers and wikis, inject attacker-controlled external tracker and wiki URLs to redirect repository visitors, and trigger mirror synchronization without authorization.

Affected Products

Gogs self-hosted Git service prior to version 0.14.3
All deployments exposing the affected REST API endpoints to authenticated users
Repositories with write-level (non-admin) collaborators

Discovery Timeline

2026-06-24 - CVE-2026-52808 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52808

Vulnerability Analysis

The vulnerability arises from inconsistent enforcement of authorization between the Gogs web interface and its REST API. The web UI gates issue tracker configuration, wiki configuration, and mirror synchronization behind reqRepoAdmin, requiring AccessMode >= AccessModeAdmin. The API router in internal/route/api/v1/api.go instead binds these same operations to reqRepoWriter(), which permits any collaborator with AccessModeWrite.

A write-level collaborator can disable the native issue tracker or wiki on a target repository. The same collaborator can substitute the external tracker or wiki URL with an attacker-controlled domain. Every repository visitor following the issue or wiki links is then redirected to that external destination, creating a phishing and malware-distribution surface. The mirror-sync endpoint can also be triggered without admin rights, allowing arbitrary refresh of mirror state.

Root Cause

The root cause is a missing privilege check. The API route definitions reference reqRepoWriter() for sensitive settings operations that the application's own access model classifies as administrator-only. This is a classic [CWE-269] improper privilege management defect where the API surface drifted out of sync with the web UI authorization policy.

Attack Vector

Exploitation requires an authenticated account holding at least write access to the target repository. The attacker issues direct HTTP calls to the three vulnerable endpoints. No user interaction from administrators or other visitors is required to plant the malicious configuration, though visitor interaction is needed to realize redirect-based payloads.

// Patch from internal/route/api/v1/api.go
// security: require admin for repo settings API endpoints (#8327)

-				m.Patch("/issue-tracker", reqRepoWriter(), bind(editIssueTrackerRequest{}), issueTracker)
-				m.Patch("/wiki", reqRepoWriter(), bind(editWikiRequest{}), wiki)
-				m.Post("/mirror-sync", reqRepoWriter(), mirrorSync)
+				m.Patch("/issue-tracker", reqRepoAdmin(), bind(editIssueTrackerRequest{}), issueTracker)
+				m.Patch("/wiki", reqRepoAdmin(), bind(editWikiRequest{}), wiki)
+				m.Post("/mirror-sync", reqRepoAdmin(), mirrorSync)

Source: Gogs commit 6283462119bd8894f1599d70339b5e823f99954a

Detection Methods for CVE-2026-52808

Indicators of Compromise

Unexpected PATCH requests to /api/v1/repos/:owner/:repo/issue-tracker or /api/v1/repos/:owner/:repo/wiki from accounts that are not repository administrators.
POST calls to /api/v1/repos/:owner/:repo/mirror-sync made by users lacking admin rights on the target repository.
Repository settings showing externally hosted issue tracker or wiki URLs that point to domains unrelated to the project.

Detection Strategies

Audit Gogs HTTP access logs for the three vulnerable endpoints and correlate the caller's repository access level against the action performed.
Compare current external_tracker_url and external_wiki_url repository settings against a known-good baseline to identify unauthorized modifications.
Review repository configuration change events for issue tracker disablement or wiki disablement performed by non-admin collaborators.

Monitoring Recommendations

Forward Gogs application and reverse-proxy logs to a centralized analytics platform and alert on API calls to repository settings endpoints by non-admin users.
Track mirror-sync invocation frequency and source identity to detect abuse of the unauthenticated trigger path.
Monitor outbound traffic from repository visitors to newly observed domains referenced by external tracker or wiki configurations.

How to Mitigate CVE-2026-52808

Immediate Actions Required

Upgrade Gogs to version 0.14.3 or later, where the API routes are gated by reqRepoAdmin().
Audit all repositories for unexpected external_tracker_url and external_wiki_url values and reset any that appear unauthorized.
Review the collaborator list on sensitive repositories and reduce write-level access where it is not strictly required.

Patch Information

The fix is included in Gogs 0.14.3. The patch swaps the middleware from reqRepoWriter() to reqRepoAdmin() on the three endpoints in internal/route/api/v1/api.go. References: GitHub Security Advisory GHSA-268j-37xf-pp52, Pull Request #8327, and the v0.14.3 release notes.

Workarounds

Restrict access to the Gogs API at the reverse-proxy layer, blocking PATCH /api/v1/repos/*/issue-tracker, PATCH /api/v1/repos/*/wiki, and POST /api/v1/repos/*/mirror-sync for non-admin users until patching.
Temporarily downgrade write-level collaborators on critical repositories to read access where feasible.
Disable the external issue tracker and wiki features at the instance level if they are not in use by the organization.

bash

# Example nginx snippet to block the vulnerable endpoints pending upgrade
location ~ ^/api/v1/repos/[^/]+/[^/]+/(issue-tracker|wiki|mirror-sync)$ {
    return 403;
}