7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52810

CVE-2026-52810: Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52810

CVE-2026-52810:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the HTTPContexter function located in internal/route/repo/http.go. This function is a middleware handler that inspects incoming Git-over-HTTP requests to determine the correct access permissions. The core of the vulnerability was in how it determined if an operation was a read (git-upload-pack) or a write (git-receive-pack). The original code checked the service query parameter, which is controlled by the client. By sending a request to the write endpoint (.../git-receive-pack) but spoofing the query parameter to service=git-upload-pack, an attacker could trick the application into applying read-only permissions to a write operation. This allowed a user who only had read access to a repository to successfully push commits, bypassing the intended access controls. The patch corrects this by ignoring the service parameter for this check and instead determines the action from the URL path itself, ensuring the authorization check matches the action being performed.

Vulnerable functions

repo.HTTPContexter

internal/route/repo/http.go

The `HTTPContexter` function contained logic that determined whether a Git HTTP request was a 'pull' (read) or 'push' (write) operation. The original logic was flawed because it trusted the client-supplied `service` query parameter. An attacker with read-only access could send a POST request to the `git-receive-pack` endpoint (a write operation) but include `?service=git-upload-pack` in the URL. The vulnerable code would incorrectly classify this as a pull request, applying read-level permissions to a write operation, thus allowing the attacker to push changes to a repository they should not have write access to.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.