CVE-2026-52799

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description Gogs is an open source self-hosted Git service. The endpoint '/attachments/:uuid' retrieves attachment records using the uuid variable provided in the URL and returns the corresponding local file without performing authorization checks against the repository or the associated Issue, Comment, or Release. This allows an unauthenticated user, or a user without proper permissions, to download attachments from private repositories if the uuid is known. This is particularly critical when the REQUIRE SIGNIN VIEW variable is set to false, though it may still be possible for authenticated users who lack specific repository access. The issue stems from the GetAttachmentByUUID() function, which performs no validation tied to repository visibility or user permissions.

Recommendations Update to version 0.14.3. As a temporary workaround, restrict access to the '/attachments/:uuid' endpoint to minimize the risk of unauthorized file downloads until the update is applied.