CVE-2026-52810

CVE Enrichment

CVSS: 7.1 HIGH
EPSS: 0.43%
EPSS Percentile: 35.97%
CISA KEV: Not listed

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. This vulnerability is fixed in 0.14.3.

Technical Details

CVSS Version: 4.0
CNA / NVD Source: [email protected]
Published: 25-Jun-2026 04:16
Last Modified: 25-Jun-2026 23:16
EPSS Date: 2026-10-23
CWE: CWE-284

CVSS Vector


            CVSS:4.0                            AV:N /
                            AC:L /
                            AT:N /
                            PR:L /
                            UI:N /
                            VC:N /
                            VI:H /
                            VA:L /
                            SC:N /
                            SI:N /
                            SA:N /
                            E:X /
                            CR:X /
                            IR:X /
                            AR:X /
                            MAV:X /
                            MAC:X /
                            MAT:X /
                            MPR:X /
                            MUI:X /
                            MVC:X /
                            MVI:X /
                            MVA:X /
                            MSC:X /
                            MSI:X /
                            MSA:X /
                            S:X /
                            AU:X /
                            R:X /
                            V:X /
                            RE:X /
                            U:X

References

Last enrichment sync: 24-Oct-2026 14:22
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

in Remote Code Execution (RCE).” The issue was addressed in version 0.14.3, alongside patches for CVE-2026-52810 (a logic bug to write on read-only repositories) and GHSA-6vxv-wg6j-5qwp (an XSS flaw in the outdated ThreatsDay: Gogs and n8n RCE Flaws, Malware Campaigns and AI Exploit Advances
most technically interesting. But I’ll also explain a logic bug to write on read-only repositories (CVE-2026-52810), together with an XSS vulnerability in the Jupyter rendering library Gogs was using Researchers Detail Gogs RCE, Push Authorization Bypass and Notebook XSS

CVE (3)

Malware (8)

People (5)

Threat Actors (4)

MITRE ATT&CK (6)

Vendors (8)

Products (9)

Tools (4)

Industries (2)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.