Remote Command Execution in uploading repository file in GitHub repository gogs/gogs prior to 0.12.6.
The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution.
In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.
Gogs through 0.11.91 allows attackers to violate the admin-specified repo-creation policy due to an internal/db/repo.go race condition.
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.