Vulnerability · Published Nov 5, 2026 · Assigned by mitre
CVE-2026-123012
High 7.1
In plain English
A high-severity security flaw in Gogs from Gogs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.3%top 74.3% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gogs.io/gogs | 0.14.3 | GHSA-wmfg-5p4h-5fw3 |
| Go | gogs.io/gogs | no fix listed | GO-2026-5712 |
Affected products (as reported)
Weakness: CWE-178 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N
References
- https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 related
- https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L415-L418 product
- https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L64-L68 product