CVE-2026-123012
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.
| CWE | CWE-178 |
| Vendor | gogs |
| Product | gogs |
| Published | Nov 5, 2026 |
| Last Updated | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for gogs gogs
Be the first to know when new unknown vulnerabilities affecting gogs gogs are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Gogs / Gogs
0.14.3
References
github.com: https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3 github.com: https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L415-L418 github.com: https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L64-L68