Back to overview

CVE-2026-25119

HIGH
7.7
CVSS 4.0
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication. This vulnerability is fixed in 0.14.3.

Metadata

CVE ID
CVE-2026-25119
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-01-29 14:03 UTC
Published
2026-06-24 20:07 UTC
Last updated
2026-06-24 20:07 UTC
Primary CWE
CWE-290
CWE-290: Authentication Bypass by Spoofing
Vendor / Product
gogs / gogs
Sources
cve.org  ·  NVD

Severity & Metrics

7.7 HIGH CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
Affected products (1)
VendorProductPlatformVersions
gogs gogs — < 0.14.3
Weakness (CWE)
CWESourceDescription
CWE-290 cna CWE-290: Authentication Bypass by Spoofing
CVSS scores (1)
ScoreSeverityVersionSourceVector
7.7 HIGH 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P
References (4)
Back to overview