8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52800

CVE-2026-52800: Gogs: CSRF Leading to Organization Owner Takeover

Gogs is an open source self-hosted Git service. Prior to 0.14.3, organization team member management can be performed via GET requests without CSRF protection. If a victim who is an organization owner is logged in and is tricked into visiting a crafted link, an attacker-controlled user can be added to the Owners team. As a result, the attacker gains organization owner–equivalent privileges. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52800

CVE-2026-52800:

8.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because several routes in the Gogs application that perform state-changing actions were configured to accept GET requests. This violates the principle that GET requests should be idempotent and not have side effects. Specifically, the routes for org.TeamsAction, org.MembersAction, and org.TeamsRepoAction were vulnerable. The vulnerability description and the provided patch 070df61ecd14c75b0aca93090f860b87ab17ac19 clearly show that the fix was to change the routing for these actions from allowing GET or GET,POST to POST only. This ensures that a CSRF token, which is validated for POST requests, is required, thus mitigating the vulnerability. The vulnerable functions themselves did not check the HTTP method and would perform actions like adding users or changing permissions based on parameters in the URL, making them susceptible to CSRF when accessed via a simple crafted link.

Vulnerable functions

org.TeamsAction

cmd/gogs/internal/web/web.go

The function `TeamsAction` was mapped to handle both GET and POST requests. This allowed for a Cross-Site Request Forgery (CSRF) attack. An attacker could craft a malicious link that, when visited by a logged-in organization owner, would trigger state-changing actions like adding a new owner to a team without the victim's consent. The function itself does not check the HTTP method and performs actions based on URL parameters.

org.MembersAction

cmd/gogs/internal/web/web.go

The function `MembersAction` was mapped to handle GET requests, making it vulnerable to Cross-Site Request Forgery (CSRF). State-changing operations such as changing a member's visibility or removing a member could be triggered by a crafted URL visited by a logged-in organization owner. The function does not validate the HTTP method before performing these actions.

org.TeamsRepoAction

cmd/gogs/internal/web/web.go

Similar to `TeamsAction`, the `TeamsRepoAction` function was accessible via GET requests, creating a CSRF vulnerability. This could allow an attacker to trick an organization owner into performing repository-related actions within a team by visiting a malicious link.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.