high7.1
CVE-2026-123012Package fixes recorded
Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion
Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed.
Recorded fixes — gogs.io/gogs: 0.14.3. Check your release branch.
Public exploit reference
gogs.io/gogs Go
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 0.14.3Semantic versions | 0.14.3 |
Version evidence: OSV · GHSA-wmfg-5p4h-5fw3
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.3"
}
],
"type": "SEMVER"
}
],
"versions": []
}gogs.io/gogs Go
| Affected range | Recorded fix |
|---|---|
| All releases from the beginning; no upper bound recordedVersions | Not recorded |
Version evidence: OSV · GO-2026-5712
View original version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "SEMVER"
}
],
"versions": []
}