CVE-2026-23632: 
Gogs vulnerability analysis and mitigation

CVE-2026-23632 is an authorization bypass vulnerability in Gogs, an open-source self-hosted Git service, that allows an authenticated user with read-only repository access to modify repository contents via the API. The flaw affects Gogs version 0.13.3 and all prior releases. It was disclosed on February 6, 2026, and has been patched in versions 0.13.4 and 0.14.0+dev. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Gogs Security Advisory).

The root cause is a missing/incorrect authorization check (CWE-862, CWE-863) in the API endpoint PUT /repos/:owner/:repo/contents/*. The repoAssignment() function performs the permission check but only validates that the requester has read access, failing to enforce the write permission requirement for content modification. Once this flawed check passes, PutContents() calls UpdateRepoFile(), which creates a Git commit and executes a git push on behalf of the attacker — effectively allowing repository writes with a read-only token. The attack requires network access, low privileges (a valid read-only token), and no user interaction (Gogs Security Advisory, GitHub Advisory).

Successful exploitation allows an attacker to tamper with source code, inject backdoors, or compromise release artifacts and distributed packages in any repository they have read access to — including public repositories. The integrity impact is rated High, as arbitrary file modifications can be committed and pushed without proper authorization. There is no confidentiality or availability impact, but supply chain compromise is a significant downstream risk if malicious code is introduced into widely used repositories (Gogs Security Advisory, GitHub Advisory).

As of the disclosure date, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is approximately 0.021% (6th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the low attack complexity and the only requirement of a read-only token make it straightforward to exploit if an attacker has any level of repository access.

1. Obtain a read-only token: Acquire a valid Gogs API access token with at minimum read permission on the target repository (e.g., via a compromised collaborator account, a leaked token, or access to a public repository).
2. Identify a target file: Browse the target repository to identify a file to modify (e.g., a build script, configuration file, or source code file).
3. Retrieve the file's SHA: Send a GET /api/v1/repos/:owner/:repo/contents/:filepath request using the read-only token to obtain the current file content and its SHA hash, which is required for the update request.
4. Craft the malicious PUT request: Construct a PUT /api/v1/repos/:owner/:repo/contents/:filepath request with the read-only token in the Authorization header, including a JSON body with the base64-encoded malicious file content, commit message, and the file's current SHA.
5. Submit the request: Send the PUT request to the vulnerable Gogs instance. The server's repoAssignment() passes the flawed permission check, PutContents() calls UpdateRepoFile(), and a commit is created and pushed to the repository on behalf of the attacker.
6. Verify the modification: Confirm the malicious commit appears in the repository's commit history (Gogs Security Advisory, GitHub Advisory).

• Network: Unexpected PUT requests to /api/v1/repos/:owner/:repo/contents/* endpoints originating from accounts or tokens that should only have read access.
• Logs: Gogs access logs showing PUT /api/v1/repos/.../contents/... HTTP 200 responses associated with read-only API tokens; commit activity attributed to users who should not have write permissions.
• Repository: Unexpected commits in repository history, particularly those modifying build scripts, CI/CD configuration files, or source code, authored by accounts with read-only access; new or modified files not corresponding to authorized change requests.
• Process: Unexpected git push operations initiated by the Gogs server process on behalf of read-only token holders.

Upgrade Gogs to version 0.13.4 or 0.14.0+dev (or later), which contain the fix for this authorization bypass (GitHub Advisory, Gogs Security Advisory). For organizations unable to patch immediately, restrict network access to the Gogs instance and enforce strong access controls on repository permissions. Additionally, review repository access logs and commit histories for any suspicious file modification activity from read-only accounts prior to patching.

The vulnerability was reported by security researcher odgrso and published by the Gogs maintainer (unknwon) on February 6, 2026, via GitHub's security advisory process. A technical write-up was published at infinitsec.net shortly after disclosure. No significant broader media coverage or notable community controversy has been identified beyond standard vulnerability tracking and aggregation sites.