CVE-2026-52799CWE-639CWE-862

Gogs: Missing Authorization in Attachment Download

High · published June 24, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
35.5
In the wild
Unconfirmed
What it is

Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester has view permission for the associated Issue/Comment/Release or the repository.

In a test environment with REQUIRE_SIGNIN_VIEW = false, we confirmed that an unauthenticated user can download attachments belonging to a private repository. This vulnerability is fixed in 0.14.3.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00422 · 35.5th percentile
Weaknesses
CWE-639 · Authorization Bypass Through User-Controlled Key; CWE-862 · Missing Authorization
Published
2026-06-24T20:19Z
EPSS history
Timeline
  • 24 JUN 20:19Z
    Gogs: Missing Authorization in Attachment Download
    cvelistv5