CVE-2026-52802: Gogs has an Open Redirect via redirect_to

June 23, 2026 (updated July 21, 2026)

An open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites.

References

github.com/advisories/GHSA-xxhq-69mf-w8cr
github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f
github.com/gogs/gogs/pull/8322
github.com/gogs/gogs/releases/tag/v0.14.3
github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr
nvd.nist.gov/vuln/detail/CVE-2026-52802

Code Behaviors & Features

Detect and mitigate CVE-2026-52802 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →