/Vulnerability Library

Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure

CVE-2026-52815
Verified

Description

Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.

Severity

Low

CVSS Score

4.3

Exploit Probability

1%

Affected Product

gogs

Published Date

June 24, 2026

Template Author

0x_akoko

CVE-2026-52815.yaml
4.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-52815
CWE ID:
cwe-200

References

https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56https://nvd.nist.gov/vuln/detail/CVE-2026-52815

Remediation Steps

Update Gogs to version 0.14.3 or later.