CVE-2026-123012High· 7.1▾ TwilightIn Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a v…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 39.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.
Gogs 0.14.3No patch available. Use case-insensitive comparison (strings.EqualFold) in gitHTTPIsPull in internal/route/repo/http.go
Disable Git Smart HTTP access (set DISABLE_HTTP_GIT = true in app.ini) and use SSH-only for Git operations
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-82402Medium· 5.3Gogs is an open source self-hosted Git service
CVE-2026-52804Medium· 5.5Gogs is an open source self-hosted Git service
CVE-2026-52805High· 8.7Gogs is an open source self-hosted Git service
CVE-2026-52809Medium· 6.8Gogs is an open source self-hosted Git service
CVE-2026-52811Critical· 9.0Gogs is an open source self-hosted Git service
CVE-2025-8110High· 8.8Improper Symbolic link handling in the PutContents API in Gogs allows Local Execution of Code.