5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52804

CVE-2026-52804: Gogs: Privilege Escalation via Collaboration Access Mode Validation

Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52804

CVE-2026-52804:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a privilege escalation caused by an off-by-one error in the database.Repository.ChangeCollaborationAccessMode function in internal/database/repo_collaboration.go. The original code checked if the requested access mode was greater than AccessModeOwner (mode > 4), which is always false for mode = 4. This allowed a collaborator with Admin access (mode=3) to escalate their privileges to Owner (mode=4).

The vulnerability was exposed through the web handler setting.ChangeCollaborationAccessMode in internal/route/repo/setting.go. This function takes the mode as a raw integer from the mode query parameter and passes it to the vulnerable ChangeCollaborationAccessMode function in the database layer. An attacker could send a POST request to /settings/collaboration/access_mode with mode=4 to trigger the privilege escalation.

The patch fixes this by:

Modifying database.Repository.ChangeCollaborationAccessMode to accept the actor's access mode.
Adding validation to ensure the new mode is not higher than 'Admin' and not higher than the actor's own access level.
Updating the call sites in internal/route/repo/setting.go and internal/route/api/v1/repo_collaborators.go to pass the actor's access mode, thus enforcing the new security check.

Vulnerable functions

database.Repository.ChangeCollaborationAccessMode

internal/database/repo_collaboration.go

The function was vulnerable to a privilege escalation because it used an incorrect boundary check (`mode > AccessModeOwner` instead of `mode >= AccessModeOwner`), allowing a user with admin access to grant themselves owner access. The patch changes the function signature to include the actor's access mode and adds stricter validation to prevent granting higher privileges.

setting.ChangeCollaborationAccessMode

internal/route/repo/setting.go

This function is the web route handler that exposes the vulnerability. It takes the access mode directly from the user's query parameter and passes it to the vulnerable `database.Repository.ChangeCollaborationAccessMode` function without proper validation of the actor's permissions. This allows an attacker to craft a request to escalate their privileges.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.