VulnerabilityAnalyzed

CVE-2026-23632

In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission only via repoAssignment().

MEDIUM 6.5EPSS 0.29%

Does this matter?

Lower severity and a low EPSS score (0.29%). Track it; it rarely justifies an emergency change on its own.

Description

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in commit creation and the execution of git push. As a result, a token with read-only permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

CVSS 3.1: 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.29% probability · 22th percentile
CISA KEV: Not listed
Weakness: CWE-862, CWE-863
Affected: gogs/gogs
Source: security-advisories@github.com

References

https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqrVendor Advisory

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.