CVE-2026-52810CWE-284

Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion

High · published June 24, 2026

CVSS v4.0
7.1
EPSS
0%
Percentile
35.9
In the wild
Unconfirmed
What it is

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. This vulnerability is fixed in 0.14.3.

The record
Technical detail
CVSS v4.0
7.1 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N
EPSS
0.00427 · 35.9th percentile
Weakness
CWE-284 · Improper Access Control
Published
2026-06-24T20:30Z
EPSS history
Timeline
  • 24 JUN 20:30Z
    Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusion
    cvelistv5