Vulnerability · Published Jun 24, 2026 · Assigned by GitHub_M
CVE-2026-52809Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_LIVES
Medium 6.8
In plain English
A medium-severity security flaw in gogs from gogs. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, password-reset tokens are generated using conf.Auth.ActivateCodeLives (the account-activation lifetime), not conf.Auth.ResetPasswordCodeLives. The token lifetime is baked into the token itself at generation time and is re-extracted from the token at verification time, making RESET_PASSWORD_CODE_LIVES irrelevant to actual enforcement. When an administrator configures a shorter reset window (e.g., 10 minutes) for compliance or security reasons, reset tokens remain exploitable for the full activation lifetime instead, while the reset email falsely advertises the shorter expiry. This vulnerability is fixed in 0.14.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gogs.io/gogs | 0.14.3 | GHSA-5c3f-6486-3g7g |
| Go | gogs.io/gogs | no fix listed | GO-2026-5140 |
Affected products (as reported)
Weakness: CWE-324, CWE-613 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/gogs/gogs/security/advisories/GHSA-5c3f-6486-3g7g x_refsource_CONFIRM
- https://github.com/gogs/gogs/releases/tag/v0.14.3 x_refsource_MISC