https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-12T23:10:20.780350+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2024-bz87721 CLEANSTART-2024-BZ87721 — Missing Authorization in GitHub repository gogs/gogs prior to 0 2026-10-12T23:10:20.783523+00:00

Affected: CleanStart: gogs

Security vulnerability affects the gogs package. Missing Authorization in GitHub repository gogs/gogs prior to 0.

 https://cve.radiocsirt.org/vuln/euvd-2026-11286 EUVD-2026-11286 2026-10-12T23:10:20.783564+00:00 EUVD-2026-11286 https://cve.radiocsirt.org/vuln/fkie_cve-2022-0871 fkie_cve-2022-0871 2026-10-12T23:10:20.783580+00:00

Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.

 https://cve.radiocsirt.org/vuln/ghsa-gw5h-h6hj-f56g GHSA-gw5h-h6hj-f56g — Gogs vulnerable to improper PAM authorization handling 2026-10-12T23:10:20.783601+00:00

Affected: Go: gogs.io/gogs

### Impact

Expired PAM accounts and accounts with expired passwords are continued to be seen as valid. Installations use PAM as authentication sources are affected.

### Patches

Expired PAM accounts and accounts with expired passwords are no longer being seen as valid. Users should upgrade to 0.12.5 or the latest 0.13.0+dev.

### Workarounds

In addition to marking PAM accounts as expired, also disable/lock them. Running `usermod -L <username>` will add an exclamation mark to the password hash and would result in wrong passwords responses when trying to login.

### References

https://huntr.dev/bounties/ea82cfc9-b55c-41fe-ae58-0d0e0bd7ab62/

### For more information

If you have any questions or comments about this advisory, please post on https://github.com/gogs/gogs/issues/6810.

 https://cve.radiocsirt.org/vuln/gsd-2022-0871 gsd-2022-0871 2026-10-12T23:10:20.783633+00:00 gsd-2022-0871