CVE-2026-123012

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description The Git Smart HTTP authorization layer in the internal/route/repo/http.go file contains a flaw where the system relies on a client-supplied service query parameter to determine the authorization policy instead of the actual RPC path being executed. Specifically, a request sent to the /repo.git/git-receive-pack endpoint (used for push/write operations) can be incorrectly treated as a read operation if the query string is set to service=git-upload-pack. This allows a user with only read-only permissions to push changes to a repository. This issue is particularly impactful on instances where REQUIRE SIGNIN VIEW is set to true, as it may allow any signed-in user to write to any repository. The flaw is caused by an inconsistency in how verbs are checked regarding case-sensitivity.

Recommendations Update Gogs to a version newer than 0.14.3. As a temporary mitigation, restrict access to the /repo.git/git-receive-pack endpoint for users who should only have read-only access.