Vulnerability advisory

CVE-2026-52810

Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion

Published Jun 24, 2026Updated Nov 5, 2026OSV record ↗

Also known as CVE-2026-123012GHSA-wmfg-5p4h-5fw3GO-2026-5712

Severity

CVSS 4.0CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/gogs/gogs ↗
All commits before 3ba8aca90e17e5410b7e8b227c9f29256ac3e875	`3ba8aca90e17e5410b7e8b227c9f29256ac3e875`
Not specified	`7c9cf53aca957959bcd98b0cc987d9901b7cb184`
Also listed as affected (60) `v0.14.2-rc.1` `v0.14.2` `v0.14.1-rc.1` `v0.14.1` `v0.14.0-rc.1` `v0.14.0` `latest-commit-build` `v0.11.91` `v0.11.86` `v0.11.79` `v0.11.66` `v0.11.53` `v0.11.43` `v0.11.34` `v0.11.33` `v0.11.29` `v0.11.19` `v0.11.4` `v0.11` `v0.11rc` `v0.10.18` `v0.10.8` `v0.10` `v0.10rc` `v0.9.141` `v0.9.128` `v0.9.113` `v0.9.97` `v0.9.71` `v0.9.60` `v0.9.48` `v0.9.46` `v0.9.13` `v0.9.0` `v0.8.43` `v0.8.25` `v0.8.10` `v0.8.0` `v0.7.33` `v0.7.22` `v0.7.19` `v0.7.6` `v0.7.0` `v0.6.15` `v0.6.9` `v0.6.3` `v0.6.1` `v0.5.13` `v0.5.11` `v0.5.9` `v0.5.8` `v0.5.5` `v0.5.2` `v0.5.0` `v0.4.2` `v0.4.1` `v0.4.0` `v0.3.1` `v0.3.0` `v0.2.0`

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST .../git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. This vulnerability is fixed in 0.14.3.

CVE-2026-52810

Affected versions

Repository

Description

References