CVE-2026-52809 gogs CVE debrief

Who should care

Administrators and security teams managing Gogs instances should be aware of this vulnerability and take action to update their instances to prevent potential security risks associated with password-reset tokens.

Why it matters

CVE-2026-52809 allows password-reset tokens to have an unintended longer lifetime, potentially leading to unauthorized access. Defenders should verify Gogs versions, update to 0.14.3 or later, and review token configurations.

• Defenders need to verify Gogs instance versions and apply patches to prevent token exploitation.
• Security teams must review and adjust password-reset configurations to align with security policies.
• Monitoring for suspicious token activity is necessary to detect potential unauthorized access attempts.

Technical summary

The Gogs self-hosted Git service has a vulnerability where password-reset tokens are generated with a lifetime based on the account activation setting (conf.Auth.ActivateCodeLives) instead of the intended password reset setting (conf.Auth.ResetPasswordCodeLives). This means that even if an administrator configures a short reset window (e.g., 10 minutes) for security or compliance, the tokens remain valid for the longer activation lifetime. This issue is addressed in Gogs version 0.14.3.

Defensive priority

Defenders should prioritize verifying their Gogs instance version and applying the patch to prevent potential unauthorized access through password-reset tokens. This involves checking the current version of Gogs and updating to version 0.14.3 or later if necessary.

Recommended defensive actions

• Verify the current version of Gogs and update to version 0.14.3 or later.
• Review and adjust the configuration of password-reset token lifetimes to align with organizational security policies.
• Monitor for any suspicious activity related to password-reset tokens.
• Perform a thorough review of existing password-reset tokens to identify potential unauthorized access.
• Implement additional logging and monitoring for Gogs instance activity.
• Conduct a security audit to ensure no unauthorized access has occurred.
• Review and update incident response plans to include procedures for potential password-reset token exploitation.

Evidence notes

The CVE record and source details indicate that Gogs versions prior to 0.14.3 are affected by this vulnerability. The issue is fixed in version 0.14.3. However, specific details about exploitation or victim impact are not provided in the source corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.