{"id":"CVE-2026-123012","kind":"vulnerability","aliases":["CVE-2026-123012"],"related":[],"title":"Gogs: Git HTTP push allowed with only read access","description":"In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.","summary":"NVD says Gogs 0.14.3 still lets a read-only account push over Git smart HTTP, because the request verb is checked in a case-sensitive way in internal/route/repo/http.go. It is described as a different bug from CVE-2026-52810, which 0.14.3 fixed. No vendor advisory or fixed version for this one has been found.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gogs","fixed":[],"affected":"0.14.3 (per NVD; vendor unconfirmed)","ecosystem":"go"}],"ecosystems":[],"tags":["git","gogs","package","self-hosted"],"not_affected_if":["no-read-only-users","ssh-only-access"],"how_to_check":"- Run `gogs --version`. 0.14.3 is the version NVD names as affected. Earlier versions are also exposed to the sibling CVE-2026-52810.\n- Check whether any user has read-only access to a repository, or whether REQUIRE_SIGNIN_VIEW = true is set in app.ini. Either one makes a push by a read-only account matter.\n- Gogs serves Git over HTTP by default. Instances that only use SSH for Git can probably skip this, but no source confirms it.","fix":null,"status":"open","published_at":"2026-11-05T05:18:36+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","triaged_at":"2026-11-05T05:33:41+00:00","updated_at":"2026-11-05T05:35:19+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-11-05T05:33:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Gogs: Git HTTP push allowed with only read access","impact":"medium","summary":"Gogs 0.14.3 checks Git Smart HTTP request verbs inconsistently, so a push can succeed when the account only has read access. An attacker with read-only access could change repository contents they were meant to only read.","audience":"businesses","category":"package","nicknames":[],"who_cares":["gogs","self-hosted","git"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"read-only account pushes changes to repositories","analyst_note":"Find the fixed Gogs version and the upstream advisory at the vendor link to confirm the affected range and fix.","how_to_check":"- Check the running Gogs version, for example `gogs --version`, and see whether it is `0.14.3`.\n- Confirm whether Git over HTTP is enabled for the instance in the app.ini settings.","plain_action":"","needs_analyst":true,"not_affected_if":["ssh-only-access","no-read-only-users"],"who_is_affected":"Teams that self-host Gogs 0.14.3 with Git over HTTP enabled and give some users read-only repository access. The sources do not name a fixed version, and they do not say whether SSH-only deployments are affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4249,"output_tokens":491,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed Gogs version and the upstream advisory at the vendor link to confirm the affected range and fix.","search":"'-123012':12A,15A '-2026':11A,14A,62B,104C '-52810':63B,105C '0.14.3':26B,65B,81C 'access':9A,96C 'account':33B 'advisori':69B 'allow':5A,90C 'author':86C 'bug':59B 'case':48B,120C 'case-sensit':47B,119C 'check':44B,116C 'cve':10A,13A,61B,103C 'describ':55B 'differ':58B,100C 'fix':66B,71B 'found':78B 'git':2A,17B,36B,83C 'gog':1A,18B,25B,80C 'gogs':16A 'host':22B 'http':3A,38B,85C 'inconsist':110C 'intend':98C 'internal/route/repo/http.go':52B,89C 'layer':87C 'let':28B 'manner':122C 'nvd':23B 'occur':107C 'one':75B 'packag':19B 'push':4A,34B,92C 'read':8A,31B,95C 'read-on':30B 'request':41B 'say':24B 'self':21B 'self-host':20B 'sensit':49B,121C 'smart':37B,84C 'still':27B 'vendor':68B 'verb':42B,114C 'version':72B 'vulner':101C 'way':50B 'whether':112C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Gogs 0.14.3 where Git over HTTP is reachable and some accounts have read-only access to repositories. NVD is the only source, and it names 0.14.3. No vendor page confirms the affected range, and no fixed version is known. Instances with no read-only users can likely skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["gogs"],"ptokens":["gogs"],"labels":["git","gogs","high","package","selfhosted"],"campaign_type":null,"first_public_at":"2026-06-19T02:18:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123012","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123012","severity":null,"published_at":"2026-11-05T05:18:36+00:00","modified_at":"2026-11-05T05:18:36+00:00","first_seen_at":"2026-11-05T05:31:54+00:00","fetched_at":"2026-11-05T05:31:54+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-123012:1757","url":"https://github.com/gogs/gogs/pull/8331","severity":null,"published_at":"2026-11-05T05:35:19+00:00","modified_at":"2026-11-05T05:35:19+00:00","first_seen_at":"2026-11-05T05:35:19+00:00","fetched_at":"2026-11-05T05:35:19+00:00","note":"The linked vendor advisory GHSA-wmfg-5p4h-5fw3 is for CVE-2026-52810, a different bug: the service= query parameter confusion, fixed in 0.14.3 (PR #8331). This CVE is described by NVD as a separate bypass in 0.14.3 caused by case-sensitive verb checking. I found no vendor advisory, fix or fixed version for it, and the NVD page returned nothing. Nothing is verified. Possible duplicate or mis-association with CVE-2026-52810; code decides merges.","cites":["https://github.com/gogs/gogs/pull/8331"]}],"documents":[{"id":73454,"url":"https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-06-19T02:18:21+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":73635,"url":"https://github.com/gogs/gogs/pull/8331","title":"gogs PR #8331: authorize Git HTTP by routed action (fix for CVE-2026-52810)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}