CVE-2026-123012: High severity vulnerability
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner,
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify gitHTTPIsPull in internal/route/repo/http.go to use case-insensitive verb comparison with strings.EqualFold.
Gogs 0.14.3 Git Smart HTTP authorization layer gitHTTPIsPull verb comparison = case-insensitive using strings.EqualFold
Event History
Frequently Asked Questions
Which deployments are exposed?
Gogs 0.14.3 deployments using the Git Smart HTTP endpoint are affected when users are intended to have read-only repository access. The issue is in the authorization handling in internal/route/repo/http.go.
What access does an attacker need?
An attacker needs network access and low-level authenticated privileges, specifically an account that has read access where push access was not intended. No user interaction is required.
What is the practical impact?
A user who should only be able to read a repository may be able to push changes through Git Smart HTTP. This can allow unauthorized modification of repository contents and may have a limited availability impact.