CVE-2026-52810: Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion

June 23, 2026 (updated August 13, 2026)

Git smart HTTP authorizes POST …/git-receive-pack using the client-supplied service query string (so ?service=git-upload-pack is evaluated as read access) while routing still runs git receive-pack, allowing push where only read should be allowed.

References

github.com/advisories/GHSA-wmfg-5p4h-5fw3
github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184
github.com/gogs/gogs/pull/8331
github.com/gogs/gogs/releases/tag/v0.14.3
github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3
nvd.nist.gov/vuln/detail/CVE-2026-52810

Code Behaviors & Features

Detect and mitigate CVE-2026-52810 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →