CVE-2026-52795

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.4

Description An authenticated user can watch a private repository without having the necessary access permissions. This occurs because the access check in the Watch API handler is inverted, specifically within the repoCtx.ViewerCanRead() function, which incorrectly returns a 404 error when a user has read access instead of when they do not. By watching a private repository, an attacker can view commit messages, branch names, issue titles, and pull request details via their dashboard activity feed. Additionally, if email notifications are enabled, the attacker may receive emails containing the content of issues and comments.

Recommendations Update to a version later than 0.14.3.