CVE-2026-23632

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23632", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-14T16:08:37.482Z", "datePublished": "2026-02-06T17:43:45.757Z", "dateUpdated": "2026-02-06T18:54:15.180Z"}, "containers": {"cna": {"title": "Gogs user can update repository content with read-only permission", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-863", "lang": "en", "description": "CWE-863: Incorrect Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr"}], "affected": [{"vendor": "gogs", "product": "gogs", "versions": [{"version": "< 0.14.0+dev", "status": "affected"}, {"version": "< 0.13.4", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T17:43:45.757Z"}, "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint \"PUT /repos/:owner/:repo/contents/*\" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in commit creation and the execution of git push. As a result, a token with read-only permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and 0.14.0+dev."}], "source": {"advisory": "GHSA-5qhx-gwfj-6jqr", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-06T18:54:08.202591Z", "id": "CVE-2026-23632", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T18:54:15.180Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23632", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-06T18:54:08.202591Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-06T18:54:11.066Z"}}], "cna": {"title": "Gogs user can update repository content with read-only permission", "source": {"advisory": "GHSA-5qhx-gwfj-6jqr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "gogs", "product": "gogs", "versions": [{"status": "affected", "version": "< 0.14.0+dev"}, {"status": "affected", "version": "< 0.13.4"}]}], "references": [{"url": "https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr", "name": "https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint \"PUT /repos/:owner/:repo/contents/*\" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in commit creation and the execution of git push. As a result, a token with read-only permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and 0.14.0+dev."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-863", "description": "CWE-863: Incorrect Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-02-06T17:43:45.757Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23632", "state": "PUBLISHED", "dateUpdated": "2026-02-06T18:54:15.180Z", "dateReserved": "2026-01-14T16:08:37.482Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-02-06T17:43:45.757Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "gogs", "vendor": "gogs", "versions": [{"status": "affected", "version": "< 0.14.0+dev"}, {"status": "affected", "version": "< 0.13.4"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:gogs:gogs:*:*:*:*:*:*:*:*", "matchCriteriaId": "674F0DE0-7669-4B02-B45E-DD60FB5D462F", "versionEndExcluding": "0.13.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint \"PUT /repos/:owner/:repo/contents/*\" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in commit creation and the execution of git push. As a result, a token with read-only permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and 0.14.0+dev."}, {"lang": "es", "value": "Gogs es un servicio Git autoalojado de c\u00f3digo abierto. En la versi\u00f3n 0.13.3 y anteriores, el endpoint 'PUT /repos/:owner/:repo/contents/*' no requiere permisos de escritura y permite el acceso solo con permiso de lectura a trav\u00e9s de repoAssignment(). Despu\u00e9s de pasar la verificaci\u00f3n de permisos, PutContents() invoca a UpdateRepoFile(), lo que resulta en la creaci\u00f3n de un commit y la ejecuci\u00f3n de git push. Como resultado, un token con permiso de solo lectura puede ser utilizado para modificar el contenido del repositorio. Este problema ha sido parcheado en las versiones 0.13.4 y 0.14.0+dev."}], "id": "CVE-2026-23632", "lastModified": "2026-06-17T10:21:52.207", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23632", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-06T18:54:08.202591Z", "version": "2.0.3"}}]}, "published": "2026-02-06T18:15:56.553", "references": [{"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://github.com/gogs/gogs/security/advisories/GHSA-5qhx-gwfj-6jqr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}, {"lang": "en", "value": "CWE-863"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-17T22:39:13.590433+00:00", "value": {"mitigation_remediation": ["Upgrade Gogs to version 0.13.4 or any later 0.14.0+dev release where the permission check is corrected", "Revoke or tightly scope any existing read\u2011only access tokens that have repository access and verify that only tokens with explicit write permissions can call the update content endpoint", "As an interim measure, audit and restrict API access for read\u2011only tokens by disabling the vulnerable endpoint or adding an authorization filter to enforce write\u2011level checks"], "summary": {"action": "Patch immediately", "impact": "Unauthorized repository modification via read\u2011only token"}, "threat_synthesis": {"affected_systems": "The issue afflicts Gogs versions 0.13.3 and earlier. The fix is included in versions 0.13.4 and 0.14.0+, and later developments. Users running any older version should review their deployment and confirm the vulnerability applies.", "description_and_impact": "The vulnerability allows a user possessing only read\u2011only permissions to modify the contents of a repository by sending a \"PUT /repos/:owner/:repo/contents/*\" request. After passing a lax permission check, the backend commits and pushes the changes, thereby granting an attacker the ability to alter, add or delete files in the target repository. This grants the attacker significant impact on confidentiality and integrity of the repository content without requiring elevated privileges.", "risk_and_exploitability": "The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% points to a very low exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The likely attack vector is a compromised read\u2011only token, a credential that an attacker may obtain through phishing or credential reuse. If such a token is used by an attacker to call the vulnerable endpoint, they can modify repository contents, potentially injecting malicious code or disrupting service."}}}}, "created": "2026-02-09T10:50:09.368074+00:00", "updated": "2026-04-17T22:45:29.936126+00:00", "vendors": ["gogs", "gogs$PRODUCT$gogs"]}