CVE-2026-52804 gogs CVE debrief

Who should care

Gogs administrators and users with repository admin collaborator access should verify their deployments and restrict access to prevent potential privilege escalations. This includes reviewing Gogs deployments for version 0.14.3 or later, restricting repository admin collaborator access, and monitoring for unusual privilege escalations. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and its potential  

Why it matters

CVE-2026-52804 is a medium-severity vulnerability in Gogs that allows repository admin collaborators to escalate privileges to owner-level access. Defenders should prioritize verifying Gogs deployments, restricting access, and monitoring for unusual activity.

• Potential privilege escalation by repository admin collaborators
• Need to verify Gogs deployments for version 0.14.3 or later
• Importance of restricting repository admin collaborator access

Technical summary

The vulnerability in Gogs arises from an off-by-one error in the ChangeCollaborationAccessMode function, allowing repository admin collaborators to escalate privileges to owner-level access. This issue is addressed in version 0.14.3. The vulnerability has a CVSS score of 5.5 and a medium severity. Defenders should prioritize verifying Gogs deployments for version 0.14.3 or later and restricting repository admin collaborator access to prevent potential privilege escalations. The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version.

Defensive priority

Defenders should prioritize verifying Gogs deployments for version 0.14.3 or later, restricting repository admin collaborator access, and monitoring for unusual privilege escalations.

Recommended defensive actions

• Verify Gogs deployments for version 0.14.3 or later
• Restrict repository admin collaborator access
• Monitor for unusual privilege escalations
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, its impact, and the fixed version. Additional information is available in the referenced GitHub commit, pull request, release, and security advisory.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.