CVE-2026-52815 Gogs: Unauthenticated Organization Teams Information Disclosure via API
Unauthenticated attackers can access organization team details via the API, exposing sensitive metadata without credentials.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-52815?
CVE-2026-52815 is a medium-severity vulnerability in gogs, published on 24 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.
Weakness: CWE-200
Which versions are affected by CVE-2026-52815?
3 open source packages ship an affected version, including gogs.io/gogs.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.14.3 |
gogs.io/gogs Go | All versions | 0.14.3 |
How do I fix CVE-2026-52815?
Upgrade gogs.io/gogs to 0.14.3 or later.
Is CVE-2026-52815 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-52815 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-744x-3838-5r56, GO-2026-5202.