CVE-2026-52804: Gogs Vulnerable to Privilege Escalation via Collaboration Access Mode Validation

June 23, 2026 (updated July 21, 2026)

A repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function.

References

github.com/advisories/GHSA-4565-r4x7-hg8j
github.com/gogs/gogs/commit/1fdc9cc28e159135cfa4d6b11ecd5daa0f8ce22b
github.com/gogs/gogs/pull/8227
github.com/gogs/gogs/releases/tag/v0.14.3
github.com/gogs/gogs/security/advisories/GHSA-4565-r4x7-hg8j
nvd.nist.gov/vuln/detail/CVE-2026-52804

Code Behaviors & Features

Detect and mitigate CVE-2026-52804 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →