CVE-2026-82402 gogs CVE debrief

Who should care

Defenders responsible for Gogs instances should assess exposure and prioritize updating to version 0.15.0+dev or later to mitigate this vulnerability. Operators of Gogs instances should review the vulnerability and take necessary actions to protect their systems. Security teams should monitor Gogs instance logs for suspicious redirect activity and verify that instances are running version 0.15.0+dev or later.

Why it matters

CVE-2026-82402 is a medium-severity open redirect vulnerability in Gogs that allows unauthenticated attackers to redirect users to attacker-controlled content, potentially leading to phishing attacks. Defenders responsible for Gogs instances should assess exposure and prioritize updating to version 0.15.0+dev or later.

• Phishing attacks may be conducted by redirecting users to attacker-controlled content.
• Defenders must verify Gogs instances are running version 0.15.0+dev or later.
• Defenders should monitor Gogs instance logs for suspicious redirect activity.

Technical summary

The vulnerability exists in the /redirect endpoint of Gogs, allowing an unauthenticated attacker to provide a backslash-containing target. This causes a normalization mismatch, enabling browsers to interpret the Location value as a scheme-relative external URL. The vulnerability is caused by a backslash normalization mismatch between the IsSameSite function in internal/urlx/urlx.go and the getRedirect function in cmd/gogs/internal/web/web.go. This allows browsers to interpret the Location value as a scheme-relative external URL. Defenders should prioritize verifying and updating Gogs instances to version 0.15.0+dev or later to mitigate this vulnerability.

Defensive priority

Defenders should prioritize verifying and updating Gogs instances to version 0.15.0+dev or later to mitigate this vulnerability.

Recommended defensive actions

• Verify Gogs instances are running version 0.15.0+dev or later.
• Update Gogs instances to version 0.15.0+dev or later if vulnerable.
• Monitor Gogs instance logs for suspicious redirect activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability is caused by a backslash normalization mismatch between the IsSameSite function in internal/urlx/urlx.go and the getRedirect function in cmd/gogs/internal/web/web.go. This allows browsers to interpret the Location value as a scheme-relative external URL.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.