CVE-2026-52815

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3

Description Gogs contains an information disclosure issue where the 'GET /api/v1/orgs/:orgname/teams' endpoint returns all teams for any organization without requiring authentication. This occurs because the route group lacks the reqToken() middleware and the listTeams() handler does not perform authentication checks. Consequently, unauthenticated callers can access team IDs, names, descriptions, and permission levels. This allows attackers to enumerate private or internal teams, map organizational structures, and identify high-value targets based on permission levels such as admin or owner.

Recommendations Update Gogs to version 0.14.3. As a temporary mitigation, restrict access to the 'GET /api/v1/orgs/:orgname/teams' endpoint.