Vulnerability-Lookup

CVE-2026-52815 (GCVE-0-2026-52815)

Vulnerability from cvelistv5 – Published: 2026-06-24 20:01 – Updated: 2026-06-24 20:01

Title

Gogs: Unauthenticated Organization Teams Information Disclosure via API

Summary

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.

Severity

5.5 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

GitHub_M

References

1 reference

URL	Tags
https://github.com/gogs/gogs/security/advisories/…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
gogs	gogs	Affected: < 0.14.3

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "gogs",
          "vendor": "gogs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.14.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.5,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-24T20:01:03.050Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56"
        }
      ],
      "source": {
        "advisory": "GHSA-744x-3838-5r56",
        "discovery": "UNKNOWN"
      },
      "title": "Gogs: Unauthenticated Organization Teams Information Disclosure via API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-52815",
    "datePublished": "2026-06-24T20:01:03.050Z",
    "dateReserved": "2026-06-08T18:11:06.660Z",
    "dateUpdated": "2026-06-24T20:01:03.050Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

FKIE_CVE-2026-52815

Vulnerability from fkie_nvd - Published: 2026-06-24 21:16 - Updated: 2026-06-24 21:16

Severity

5.5 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "gogs",
          "vendor": "gogs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.14.3"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3."
    }
  ],
  "id": "CVE-2026-52815",
  "lastModified": "2026-06-24T21:16:57.627",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.5,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "PROOF_OF_CONCEPT",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-06-24T21:16:57.627",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

GHSA-744X-3838-5R56

Vulnerability from github – Published: 2026-06-23 17:13 – Updated: 2026-06-23 17:13

Summary

Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API

Details

Summary

Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.

Affected Versions

Gogs (all current versions)

Vulnerability Details

Root Cause: Missing reqToken() middleware on org teams route group

internal/route/api/v1/api.go lines 380-385:

// Org teams route group — no reqToken() middleware
m.Group("/:orgname", func() {
    m.Get("/teams", org.ListTeams) // No auth required
}, orgAssignment(true))

The orgAssignment(true) middleware only loads the organization object — it performs no authentication. The listTeams() handler at org_team.go:8 returns all teams unconditionally:

func ListTeams(c *context.APIContext) {
    org := c.Org.Organization
    teams, err := database.GetTeamsByOrgID(org.ID)
    // Returns all teams — no c.IsLogged check, no permission check
}

Compare with other org endpoints that correctly require authentication:

m.Group("/orgs/:orgname", func() {
    // ... other endpoints ...
}, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth

Attack Chain

Attacker sends GET /api/v1/orgs/target-org/teams with no authentication
orgAssignment(true) loads the organization but does not check auth
ListTeams() queries all teams and returns them
Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner)

Proof of Concept

# List all teams in an organization — no authentication needed
curl -s "http://TARGET:3000/api/v1/orgs/myorg/teams" | python3 -m json.tool

# Expected: 200 OK with full team list
# [
#   {
#     "id": 1,
#     "name": "Owners",
#     "description": "Admin team",
#     "permission": "owner"
#   },
#   {
#     "id": 2,
#     "name": "backend-devs",
#     "description": "Backend development team",
#     "permission": "write"
#   }
# ]

Impact

An unauthenticated attacker can:

Enumerate all teams within any organization, including private/internal teams
Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning
Map organizational structure and identify high-value targets (admin/owner teams)
Harvest team IDs for use in other API calls that may have weaker authorization checks

Suggested Remediation

m.Group("/:orgname", func() {
    m.Get("/teams", org.ListTeams)
}, reqToken(), orgAssignment(true))

Add reqToken() middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, ListTeams() should verify the authenticated user is a member of the organization.

Severity

5.5 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-52815"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-23T17:13:25Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nGogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.\n\n## Affected Versions\n\nGogs (all current versions)\n\n## Vulnerability Details\n\n### Root Cause: Missing reqToken() middleware on org teams route group\n\n`internal/route/api/v1/api.go` lines 380-385:\n\n```go\n// Org teams route group \u2014 no reqToken() middleware\nm.Group(\"/:orgname\", func() {\n    m.Get(\"/teams\", org.ListTeams) // No auth required\n}, orgAssignment(true))\n```\n\nThe `orgAssignment(true)` middleware only loads the organization object \u2014 it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally:\n\n```go\nfunc ListTeams(c *context.APIContext) {\n    org := c.Org.Organization\n    teams, err := database.GetTeamsByOrgID(org.ID)\n    // Returns all teams \u2014 no c.IsLogged check, no permission check\n}\n```\n\nCompare with other org endpoints that correctly require authentication:\n\n```go\nm.Group(\"/orgs/:orgname\", func() {\n    // ... other endpoints ...\n}, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth\n```\n\n### Attack Chain\n\n- Attacker sends `GET /api/v1/orgs/target-org/teams` with no authentication\n- `orgAssignment(true)` loads the organization but does not check auth\n- `ListTeams()` queries all teams and returns them\n- Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner)\n\n## Proof of Concept\n\n```bash\n# List all teams in an organization \u2014 no authentication needed\ncurl -s \"http://TARGET:3000/api/v1/orgs/myorg/teams\" | python3 -m json.tool\n\n# Expected: 200 OK with full team list\n# [\n#   {\n#     \"id\": 1,\n#     \"name\": \"Owners\",\n#     \"description\": \"Admin team\",\n#     \"permission\": \"owner\"\n#   },\n#   {\n#     \"id\": 2,\n#     \"name\": \"backend-devs\",\n#     \"description\": \"Backend development team\",\n#     \"permission\": \"write\"\n#   }\n# ]\n```\n\n## Impact\n\nAn unauthenticated attacker can:\n\n- Enumerate all teams within any organization, including private/internal teams\n- Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning\n- Map organizational structure and identify high-value targets (admin/owner teams)\n- Harvest team IDs for use in other API calls that may have weaker authorization checks\n\n## Suggested Remediation\n\n```go\nm.Group(\"/:orgname\", func() {\n    m.Get(\"/teams\", org.ListTeams)\n}, reqToken(), orgAssignment(true))\n```\n\nAdd `reqToken()` middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, `ListTeams()` should verify the authenticated user is a member of the organization.",
  "id": "GHSA-744x-3838-5r56",
  "modified": "2026-06-23T17:13:25Z",
  "published": "2026-06-23T17:13:25Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/pull/8336"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/commit/2ebc0e27069deade992219e10a89fbc44bec8bb9"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/releases/tag/v0.14.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CVE-2026-52815 (GCVE-0-2026-52815)

FKIE_CVE-2026-52815

GHSA-744X-3838-5R56

Summary

Affected Versions

Vulnerability Details

Root Cause: Missing reqToken() middleware on org teams route group

Attack Chain

Proof of Concept

Impact

Suggested Remediation

Tags

Sightings

Nomenclature