5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-52815

CVE-2026-52815: Gogs: Unauthenticated Organization Teams Information Disclosure via API

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-52815

CVE-2026-52815:

5.5

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
gogs.io/gogs	go	< 0.14.3	0.14.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the routing definitions of the Gogs API, located in internal/route/api/v1/api.go. A specific route group handling organization-related endpoints (/api/v1/orgs/:orgname) was configured without the necessary reqToken() authentication middleware. This oversight exposed multiple handler functions within this group to unauthenticated access. The primary functions affected were org.ListTeams, org.getOrg, and org.editOrg. An unauthenticated attacker could leverage this to call these API endpoints to list sensitive team information or retrieve and modify organization metadata. The vulnerability was fixed in commit 2ebc0e27069deade992219e10a89fbc44bec8bb9 by adding the reqToken() middleware to the entire route group, thereby enforcing authentication for all associated endpoints. The commit message, "security: require token auth for org metadata and team list", explicitly confirms that the patch addresses both the team list and organization metadata endpoints.

Vulnerable functions

org.ListTeams

internal/route/api/v1/api.go

The function `ListTeams` (aliased as `listTeams`) is the handler for the `/api/v1/orgs/:orgname/teams` endpoint. It was part of a route group that was missing the `reqToken()` authentication middleware. This allowed an unauthenticated attacker to list all teams within any organization, exposing team names, descriptions, and permission levels. The function itself does not perform any authentication checks.

org.getOrg

internal/route/api/v1/api.go

The function `getOrg` is the handler for the `GET /api/v1/orgs/:orgname` endpoint. It was part of the same route group as `ListTeams` and was also missing the `reqToken()` authentication middleware. The commit message 'require token auth for org metadata' confirms that this endpoint, which retrieves organization metadata, was also vulnerable to unauthenticated access.

org.editOrg

internal/route/api/v1/api.go

The function `editOrg` is the handler for the `PATCH /api/v1/orgs/:orgname` endpoint. It was part of the same route group as `ListTeams` and was also missing the `reqToken()` authentication middleware. The commit message 'require token auth for org metadata' confirms that this endpoint, which is used to edit organization metadata, was also vulnerable to unauthenticated access.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.