CVE-2026-23632

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.13.4

Description Gogs, a self-hosted Git service, has an issue where the API endpoint ''PUT /repos/:owner/:repo/contents/'' does not enforce write permissions correctly. It allows modification of repository contents using a token with only read permission. This occurs because the repoAssignment() function does not adequately verify permissions before invoking PutContents(), which then calls UpdateRepoFile(), leading to commit creation and a git push operation. The username and password are not directly involved in this issue. The vulnerable parameter is the file path specified in the request to the ''PUT /repos/:owner/:repo/contents/'' endpoint.

Recommendations Update Gogs to version 0.13.4 or later.