6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-23632

CVE-2026-23632: Gogs user can update repository content with read-only permission

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in commit creation and the execution of git push. As a result, a token with read-only permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-23632

CVE-2026-23632:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	<= 0.13.3	0.13.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the API endpoint for updating repository contents (PUT /repos/:owner/:repo/contents/*) did not properly verify user permissions, allowing users with only read access to modify files. The analysis of the provided patch b6afcdb2e8d291e2adaaf6a8b7f88d240606515d confirms this. The patch is in internal/route/api/v1/api.go and it adds a reqRepoWriter() middleware to the route that handles file content updates. This middleware is responsible for checking if the user has write permissions.

The primary vulnerable function is repo.PutContents, which is the handler for the affected route. Before the patch, it was directly exposed without a proper authorization check. The vulnerability description also mentions that PutContents calls UpdateRepoFile to perform the git operations. Therefore, both repo.PutContents and repo.UpdateRepoFile would be present in the stack trace during an exploit and are considered the vulnerable functions.

Vulnerable functions

repo.PutContents

internal/route/api/v1/api.go

This function is the handler for the `PUT /repos/:owner/:repo/contents/*` endpoint. The vulnerability lies in the routing configuration within `RegisterRoutes` function, which, prior to the patch, did not enforce write permissions before calling `repo.PutContents`. This allowed an attacker with only read permissions to modify repository content. The patch adds the `reqRepoWriter()` middleware to ensure the user has write access.

repo.UpdateRepoFile

internal/route/api/v1/repo/contents.go

This function is called by `repo.PutContents` to perform the actual file update, commit, and push operations. As it is part of the execution flow when the vulnerability is triggered, it would appear in a runtime profile during exploitation.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.