6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52809

CVE-2026-52809: Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES

Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), not conf.Auth.ResetPasswordCodeLives. The token lifetime is baked into the token itself at generation time and is re-extracted from the token at verification time, making RESET_PASSWORD_CODE_LIVES irrelevant to actual enforcement. When an administrator configures a shorter reset window (e.g., 10 minutes) for compliance or security reasons, reset tokens remain exploitable for the full activation lifetime instead, while the reset email falsely advertises the shorter expiry. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52809

CVE-2026-52809:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Total

Select your environment

→SSVCScheduled60 days

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the generation of password reset tokens. The system was using the lifetime intended for account activation codes (conf.Auth.ActivateCodeLives) instead of the one configured for password resets (conf.Auth.ResetPasswordCodeLives). This discrepancy created a security flaw where password reset tokens remained valid for a much longer period than specified by the administrator, increasing the window for potential misuse if a token was intercepted.

The root cause is in the userx.GenerateActivateCode function, which was used for both account activation and password resets but was hardcoded to use the activation code's lifetime. The email.SendResetPasswordMail function triggered this vulnerability by calling GenerateActivateCode to generate the token for password reset emails.

During exploitation, an attacker would use a reset token that should have expired according to RESET_PASSWORD_CODE_LIVES but is still valid due to the longer ACTIVATE_CODE_LIVES. The exploitation process would involve the auth.ResetPasswdPost and auth.verifyUserActiveCode functions, which handle the submission and verification of the reset token. Although these verification functions are not themselves vulnerable (they correctly validate the token based on its embedded lifetime), they are key components in the exploitation chain.

Vulnerable functions

userx.GenerateActivateCode

internal/userx/userx.go

This function was used to generate both account activation and password reset codes. It incorrectly used the account activation lifetime (`conf.Auth.ActivateCodeLives`) for password reset tokens, ignoring the specific lifetime setting for password resets (`conf.Auth.ResetPasswordCodeLives`). This resulted in password reset tokens having a much longer validity period than intended.

email.SendResetPasswordMail

internal/email/email.go

This function is responsible for sending password reset emails. In its vulnerable state, it called `GenerateEmailActivateCode` to create the reset token, which in turn used the incorrect, longer lifetime. This function was the trigger for generating the flawed password reset tokens.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.