Gogs Git HTTP authorization lets read-only users push to private repos

Read-only users can change private code repositories.

Summary

Gogs 0.14.3's Git HTTP authorization mishandles letter case in URLs, so a read-only collaborator can push to private repositories. The attacker must be logged in.

Affected when

Gogs 0.14.3 or a build from the same code
authenticated read-only collaborator account
target is a private repository

What to do

No source names a fixed version. Update to a newer fixed build and read the vendor's advisory. Until then, at a reverse proxy, reject Git Smart HTTP requests with uppercase letters after owner/repo.

Products and platforms

Windows
macOS
Linux
Gogs

CVE IDs

CVE-2026-123012 (opens in a new tab)

Sources

Write-up: humanoid.sh (opens in a new tab) · github.com (opens in a new tab)

Times

First published 2026-11-05 04:52 UTC

First seen 2026-11-09 16:20 UTC