PT-2026-6852 · Go · Gogs.Io/Gogs
Publicado
2026-02-06
·
Atualizado
2026-02-06
CVSS v3.1
6.5
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Vulnerability Description
The endpoint
PUT /repos/:owner/:repo/contents/*
does not require write permissions and allows access with read permission only via repoAssignment().After passing the permission check,
PutContents() invokes UpdateRepoFile(), which results in:- Commit creation
- Execution of
git push
As a result, a token with read-only permission can be used to modify repository contents.
Attack Prerequisites
- Possession of a valid access token
- Read permission on the target repository (public repository or collaborator with read access)
Attack Scenario
- The attacker accesses the target repository with a read-only token
- The attacker sends a
PUT /contentsrequest to update an arbitrary file - The server creates a commit and performs a git push on behalf of the attacker
Potential Impact
- Source code tampering
- Injection of backdoors
- Compromise of release artifacts and distributed packages
Correção
Incorrect Authorization
Missing Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Gogs.Io/Gogs