PT-2026-51458 · Gogs · Gogs
CVE-2026-52800
·
Published
2026-06-23
·
Updated
2026-07-30
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Gogs versions prior to 0.14.3
Description
Organization team member management can be performed via GET requests without Cross-Site Request Forgery (CSRF) protection. CSRF is a security flaw where an attacker tricks a logged-in user into executing unwanted actions on a web application. If an organization owner is tricked into visiting a crafted link, an attacker-controlled user can be added to the Owners team, granting the attacker organization owner-equivalent privileges.
Technical details include:
- API Endpoints: '/teams/:team/action/:action' and '/members/action/:action' are exposed via GET requests, allowing state-changing operations to bypass CSRF validation, which is only applied to POST requests.
- Vulnerable Parameters: The
uidandunamequery parameters, along with the:actionpath parameter, are used to execute these operations. - Function Names: The
TeamsAction()andMembersAction()functions perform state changes regardless of the HTTP method used.
Recommendations
Update to version 0.14.3.
As a temporary workaround, restrict access to the '/teams/:team/action/:action' and '/members/action/:action' endpoints to authorized administrative networks to minimize the risk of exploitation.
Exploit
Fix
CSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Gogs