CVE-2026-52812

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description Git LFS storage is content-addressed by OID (Object Identifier) alone, while per-repository authorization is managed in the lfs object table. The serveUpload function skips the re-upload process when an OID file already exists on disk and inserts a new (repo id, oid) row without verifying that the request body hashes to the claimed OID. This occurs because the dedupe shortcut in the Upload function returns success without performing a hash check.

Consequently, any user with write access to one repository can bind their repository to an OID owned by a private repository. This allows the attacker to download the original bytes of the private file via their own download endpoint. This issue leads to cross-tenant disclosure of any LFS object on the instance, which may include sensitive data such as certificates, keys, or PII.

Recommendations Update to version 0.14.3. As a temporary workaround, restrict write access to repositories for untrusted users to minimize the risk of unauthorized OID binding.