Security Advisory

CVE-2026-52810

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-06-24 20:30:41

Last updated 2026-06-25 14:39:12

Assigner GitHub_M

CVSS score 7.1

State PUBLISHED

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed. This vulnerability is fixed in 0.14.3.

← Browse all CVEs View on cve.org ↗