CVE-2026-52815: Gogs Information Disclosure Vulnerability

CVE-2026-52815 Overview

CVE-2026-52815 is an unauthenticated information disclosure vulnerability in Gogs, an open source self-hosted Git service. Versions prior to 0.14.3 expose organization team data through the GET /api/v1/orgs/:orgname/teams endpoint without requiring authentication. Any unauthenticated remote caller can enumerate team identifiers, names, descriptions, and permission levels for any organization hosted on the affected instance. The flaw is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Maintainers fixed the issue in Gogs 0.14.3.

Critical Impact
Attackers can enumerate internal organization team structure and permission levels remotely without credentials, enabling reconnaissance for follow-on targeted attacks against privileged teams.

Affected Products

Gogs versions prior to 0.14.3
Self-hosted Gogs Git service instances exposing the API endpoint
Any deployment using the vulnerable internal/route/api/v1/org_team.go route handler

Discovery Timeline

2026-06-24 - CVE-2026-52815 published to the National Vulnerability Database
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-52815

Vulnerability Analysis

The vulnerability resides in the Gogs API v1 route handler for organization teams. The endpoint GET /api/v1/orgs/:orgname/teams is defined at internal/route/api/v1/org_team.go:8 and is registered within the route group declared at internal/route/api/v1/api.go:380-385. That route group omits the reqToken() middleware that other privileged endpoints rely on for authentication enforcement.

Because the middleware chain skips token validation, the listTeams() handler executes without verifying the caller's identity. The handler returns the full team listing for the requested organization, including team IDs, team names, descriptions, and permission levels such as read, write, admin, or owner. An attacker only needs to know or guess an organization name to retrieve this data.

The exposed permission metadata is particularly valuable for reconnaissance. Attackers can identify which teams hold elevated privileges, then prioritize phishing or credential attacks against members of those high-value teams.

Root Cause

The root cause is a missing authorization control on a sensitive API route. The route group registration in api.go does not chain the reqToken() middleware, and the listTeams() handler performs no in-function authentication or authorization check. This violates the principle of secure defaults for endpoints that expose organizational metadata.

Attack Vector

Exploitation requires only network access to the Gogs instance and knowledge of a target organization name. An attacker issues an HTTP GET request to /api/v1/orgs/<orgname>/teams with no Authorization header or session cookie. The server responds with a JSON array describing every team in that organization. No verified public proof-of-concept exploit code is published; the GitHub Security Advisory GHSA-744x-3838-5r56 describes the issue at the source-code level. See the GitHub Security Advisory for technical details.

Detection Methods for CVE-2026-52815

Indicators of Compromise

Unauthenticated HTTP GET requests to /api/v1/orgs/*/teams in Gogs access logs
Sequential or scripted requests across multiple organization names from the same source IP, indicating enumeration
Requests to the teams endpoint lacking an Authorization: token header or session cookie

Detection Strategies

Parse Gogs web server and application logs for GET /api/v1/orgs/ requests and flag responses returning HTTP 200 without an associated authenticated session
Correlate access patterns to detect organization name enumeration sweeps against the API
Compare the installed Gogs version against 0.14.3 using configuration management or software inventory tooling

Monitoring Recommendations

Enable verbose API access logging in Gogs and forward logs to a centralized analytics platform for retention and query
Alert on high request volume to /api/v1/orgs/ endpoints from any single source within a short time window
Monitor egress from Gogs servers for anomalous response sizes returned to unauthenticated clients

How to Mitigate CVE-2026-52815

Immediate Actions Required

Upgrade Gogs to version 0.14.3 or later on all self-hosted instances
Restrict network access to the Gogs API using firewall rules or a reverse proxy that requires authentication for /api/v1/ paths
Audit recent access logs for unauthenticated requests to /api/v1/orgs/*/teams and assess what organization metadata was exposed

Patch Information

The vulnerability is fixed in Gogs 0.14.3. The fix adds the reqToken() middleware to the affected route group and enforces authentication in the listTeams() handler. Refer to the Gogs GHSA-744x-3838-5r56 advisory for upgrade instructions and the patch commit reference.

Workarounds

Place Gogs behind a reverse proxy such as nginx or Caddy and require client authentication or IP allowlisting for /api/v1/orgs/ paths until the upgrade is applied
Block external access to the /api/v1/ route at the network perimeter and restrict it to trusted internal networks
If team metadata exposure is unacceptable, take the Gogs instance offline until the patch is deployed

bash

# Example nginx configuration to block unauthenticated access to the vulnerable route
location ~ ^/api/v1/orgs/[^/]+/teams$ {
    if ($http_authorization = "") {
        return 401;
    }
    proxy_pass http://gogs_backend;
}