7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52808

CVE-2026-52808: Gogs: Write-level collaborators can mutate admin-only repository settings via API

Gogs is an open source self-hosted Git service. Prior to 0.14.3, three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync — are gated by reqRepoWriter() rather than reqRepoAdmin(). The equivalent operations in the web UI sit behind reqRepoAdmin, which requires AccessMode >= AccessModeAdmin. A write-level collaborator (who has AccessMode == AccessModeWrite < AccessModeAdmin) can therefore call these API endpoints directly to disable the native issue tracker or wiki, inject attacker-controlled external tracker/wiki URLs that redirect all repository visitors, or trigger mirror sync — none of which they are authorized to do. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52808

CVE-2026-52808:

7.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an incorrect authorization issue within the Gogs API. Three API endpoints, responsible for managing repository issue tracker settings, wiki settings, and mirror synchronization, were protected by middleware that only required write-level access (reqRepoWriter) instead of administrator-level access (reqRepoAdmin). The provided commit patch explicitly shows the fix: in internal/route/api/v1/api.go, the middleware for the routes calling the issueTracker, wiki, and mirrorSync functions was changed from reqRepoWriter to the more restrictive reqRepoAdmin. Consequently, an attacker with write permissions could send a crafted API request to these endpoints to execute the corresponding handlers (issueTracker, wiki, mirrorSync), which would then modify repository settings without proper authorization. These three handler functions are the runtime indicators of the exploit, as they are the final destination of the unauthorized API calls.

Vulnerable functions

issueTracker

internal/route/api/v1/repo_repo.go

This function serves as the handler for the `/issue-tracker` API endpoint. The vulnerability stems from the routing configuration in `internal/route/api/v1/api.go`, which incorrectly applies the `reqRepoWriter` middleware instead of `reqRepoAdmin`. This flaw permits users with mere write access to invoke this function and alter the repository's issue tracker settings, a privilege that should be exclusively reserved for administrators.

wiki

internal/route/api/v1/repo_repo.go

This function acts as the handler for the `/wiki` API endpoint. The vulnerability is located in the routing layer (`internal/route/api/v1/api.go`), which erroneously uses the `reqRepoWriter` middleware. This allows users with write access to modify the repository's wiki settings, an action that should be restricted to administrators through the `reqRepoAdmin` middleware.

mirrorSync

internal/route/api/v1/repo_repo.go

This function is the handler for the `/mirror-sync` API endpoint. The security flaw lies in the routing mechanism (`internal/route/api/v1/api.go`), which improperly uses the `reqRepoWriter` middleware. As a result, a user with write permissions can trigger a mirror sync, an operation that should be exclusively available to repository administrators.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.