CVE-2026-52808

Gogs's write-level collaborators can mutate admin-only repository settings via API

Published

2026-06-23

Modified

2026-07-21

EPSS percentile

38%

Aliases

GHSA-268j-37xf-pp52

Sources

github-advisory

Summary

## Summary Three API endpoints — `PATCH /api/v1/repos/:owner/:repo/issue-tracker`, `PATCH /api/v1/repos/:owner/:repo/wiki`, and `POST /api/v1/repos/:owner/:repo/mirror-sync` — are gated by `reqRepoWriter()` rather than `reqRepoAdmin()`. The equivalent operations in the web UI sit behind `reqRepoAdmin`, which requires `AccessMode >= AccessModeAdmin`. A write-level collaborator (who has `AccessMode == AccessModeWrite = AccessModeWrite`: ```go func reqRepoWriter() macaron.Handler { return func(c *context.Context) { if !c.Repo.IsWriter() { c.Status(http.StatusForbidden) return } } } ``` The handlers themselves perform no additional privilege check before mutating state: ```go // internal/route/api/v1/repo_repo.go:400-428 func issueTracker(c *context.APIContext, form editIssueTrackerRequest) { _, repo := parseOwnerAndRepo(c) ... if form.EnableExternalTracker != nil { repo.EnableExternalTracker = *form.EnableExternalTracker } if form.ExternalTrackerURL != nil { repo.ExternalTrackerURL = *form.ExternalTrackerURL // ← attacker-controlled URL written directly } ... database.UpdateRepository(repo, false) // ← no admin check before this call } ``` The `wiki()` handler (lines 437–461) follows the same pattern, writing `repo.ExternalWikiURL` directly and calling `UpdateRepository` with no admin gate. ### The web UI imposes a stricter admin requirement for the same operations `cmd/gogs/web.go:472` wraps the entire `/settings` subtree with `reqRepoAdmin`: ```go // cmd/gogs/web.go:425-472 m.Group("/:username/:reponame", func() { m.Group("/settings", func() { m.Combo("").Get(repo.Settings). Post(bindIgnErr(form.RepoSetting{}), repo.SettingsPost) ... }, ...) }, req

Affected packages

Remediation: Upgrade to 0.14.3 or later.

References

• https://github.com/advisories/GHSA-268j-37xf-pp52