UpHeron
All vulnerabilities

Servers and applications

CVE-2026-123012

In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.

Severity
High 7.1
Published
5 Nov 2026
Last changed
5 Nov 2026
Added to UpHeron
5 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
GogsServers and applications · cna:gogs|gogs
  • Version 0.14.3

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-123012