Most recent entries from all

EUVD-2026-330272

fkie_cve-2026-52815

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.

GHSA-744x-3838-5r56 — Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API

Affected: Go: gogs.io/gogs

## Summary

Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.

## Affected Versions

Gogs (all current versions)

## Vulnerability Details

### Root Cause: Missing reqToken() middleware on org teams route group

`internal/route/api/v1/api.go` lines 380-385:

```go // Org teams route group — no reqToken() middleware m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) // No auth required }, orgAssignment(true)) ```

The `orgAssignment(true)` middleware only loads the organization object — it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally:

```go func ListTeams(c *context.APIContext) { org := c.Org.Organization teams, err := database.GetTeamsByOrgID(org.ID) // Returns all teams — no c.IsLogged check, no permission check } ```

Compare with other org endpoints that correctly require authentication:

```go m.Group("/orgs/:orgname", func() { // ... other endpoints ... }, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth ```

### Attack Chain

- Attacker send…

WID-SEC-W-2026-2013 — Gogs: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um erweiterte Berechtigungen zu erlangen, beliebigen Code auszuführen – sogar mit erweiterten Berechtigungen, was zur vollständigen Kontrolle über das System führen kann –, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, Cross-Site-Scripting-Angriffe durchzuführen, Benutzer auf bösartige Websites umzuleiten oder einen Denial-of-Service-Zustand zu verursachen.