CVE-2026-123012 in Gogs
Summary
by MITRE • 11/05/2026
In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The vulnerability identified in Gogs version 0.14.3 represents a critical authorization bypass within the Git Smart HTTP protocol implementation, specifically located in the internal/route/repo/http.go module. This flaw allows an authenticated user with only read permissions to execute write operations, such as pushing code changes to a repository where they should strictly have limited access. The root cause of this security failure lies in an inconsistency regarding case sensitivity when validating HTTP verbs during the authorization check process. In standard web application frameworks and Git Smart HTTP implementations, specific methods like GET are used for reading data while POST is utilized for submitting new information or modifying state. However, due to a logic error in how these verb strings were compared against allowed permissions, an attacker could exploit this discrepancy by sending requests with non-standard casing of the method name. For instance, if the system checks for lowercase get but fails to strictly enforce case sensitivity on uppercase GET variations during certain code paths, or vice versa depending on the specific implementation detail, it creates a window where authorization rules are bypassed.
This type of vulnerability is classified under CWE-269 Improper Privilege Management and more specifically aligns with CWE-862 Missing Authorization checks within the context of HTTP method validation. The ATT&CK framework categorizes this behavior under T1078 Valid Accounts, as it involves an attacker leveraging legitimate credentials to perform actions outside their designated privilege level. Unlike CVE-2026-52810 which addresses a different vector or mechanism in Gogs, this issue is distinct because it targets the fundamental access control logic governing HTTP verb handling rather than authentication token manipulation or other related flaws. The inconsistency suggests that the codebase likely contains conditional statements where string comparison for method types does not utilize case-insensitive matching consistently across all execution paths, allowing a crafted request to slip through permission filters intended to restrict write operations to authorized users only.
The operational impact of this vulnerability is severe for any organization relying on Gogs as their primary Git hosting solution. An attacker with read-only access could push malicious code, introduce backdoors, or overwrite critical project files without detection by standard audit logs that might not flag the method discrepancy if logging relies solely on successful operation outcomes rather than intent verification. This compromises the integrity of source code repositories and violates the principle of least privilege essential for secure software development lifecycles. Furthermore it undermines trust in version control systems where access controls are expected to be rigidly enforced regardless of minor variations in request formatting.
Mitigation strategies must focus on enforcing strict case-sensitive validation or standardizing all HTTP method comparisons to a canonical form before authorization checks occur. Developers should update the internal/route/repo/http.go module to ensure that verb checking is consistent and robust against casing variations. Additionally implementing comprehensive input validation at the gateway level can help normalize requests before they reach application logic. Upgrading to patched versions of Gogs where this inconsistency has been resolved is the primary remediation step for affected deployments until manual code review confirms proper enforcement of HTTP method permissions across all endpoints.