Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M
CVE-2026-52804Gogs: Privilege Escalation via Collaboration Access Mode Validation
Medium 5.5
In plain English
A medium-severity security flaw in gogs from gogs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 4.0)5.5Medium
Exploit odds (30 days)0.5%top 57.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. This vulnerability is fixed in 0.14.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gogs.io/gogs | 0.14.3 | GHSA-4565-r4x7-hg8j |
| Go | gogs.io/gogs | no fix listed | GO-2026-5110 |
Affected products (as reported)
Weakness: CWE-193 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
References
- https://github.com/gogs/gogs/security/advisories/GHSA-4565-r4x7-hg8j x_refsource_CONFIRM
- https://github.com/gogs/gogs/pull/8227 x_refsource_MISC
- https://github.com/gogs/gogs/commit/1fdc9cc28e159135cfa4d6b11ecd5daa0f8ce22b x_refsource_MISC
- https://github.com/gogs/gogs/releases/tag/v0.14.3 x_refsource_MISC