CVE-2026-52816

Gogs, an open source Git service, prior to version 0.14.3 has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication.

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorized POST …/git-receive-pack using the client-supplied service query string, allowing push where only read should be allowed.

Gogs is an open source Git service that prior to version 0.14.3 had an open redirect vulnerability. Attacker-controlled redirect_to parameters could bypass validation, allowing redirection to arbitrary external sites.

Gogs is an open source Git service that prior to version 0.14.3 allowed downloading attachments without verifying user permissions. Unauthenticated users could download attachments from private repositories.

Gogs is an open-source Git service that prior to version 0.14.3 had a vulnerability allowing the execution of malicious JavaScript code. Although .ipynb previews were sanitized on the server side, their content was re-rendered on the client side without proper sanitization, leading to the possibility of XSS attacks.

Gogs is an open source Git service that, prior to version 0.14.0, allowed authorized users to manipulate the value passed to the git diff command. This enabled users to bypass filtering and write the comparison result to any arbitrary location.

Gogs is an open source Git service that prior to version 0.14.3 was vulnerable to a panic error when rendering a specially crafted issue index pattern, resulting in denial of service.

Gogs is an open-source Git service that in version 0.14.3 and earlier allows authenticated users to watch private repositories they do not have access to. The issue arises from an incorrectly implemented access check in the Watch API, enabling attackers to access information from private repositories.

Gogs is an open source self-hosted Git service. In versions prior to 0.14.3, the fix for CVE-2022-1285 prevented adding webhooks or running them with URLs whose hostname resolves in localCIDRs. However, webhooks still follow redirects allowing access to hostnames inside localCIDRs.

Gogs is an open source Git service that prior to version 0.14.3 accepted the authentication header without verifying that the request came from a trusted reverse proxy. This allowed attackers to impersonate users or trigger automatic account creation.