Back to overview

CVE-2026-52804

MEDIUM
5.5
CVSS 4.0
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, a repository admin collaborator can escalate their privileges to owner-level access by exploiting an off-by-one error in the ChangeCollaborationAccessMode function. This vulnerability is fixed in 0.14.3.

Metadata

CVE ID
CVE-2026-52804
State
PUBLISHED
Assigner
GitHub_M
Reserved
2026-06-08 18:02 UTC
Published
2026-06-24 20:20 UTC
Last updated
2026-06-24 20:20 UTC
Primary CWE
CWE-193
CWE-193: Off-by-one Error
Vendor / Product
gogs / gogs
Sources
cve.org  ·  NVD

Severity & Metrics

5.5 MEDIUM CVSS 4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
Affected products (1)
VendorProductPlatformVersions
gogs gogs — < 0.14.3
Weakness (CWE)
CWESourceDescription
CWE-193 cna CWE-193: Off-by-one Error
CVSS scores (1)
ScoreSeverityVersionSourceVector
5.5 MEDIUM 4.0 cna CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:P
References (4)
Back to overview