Gogs user can update repository content with read-only permission in gogs.io/gogs

Open Source Vulnerabilities CVE-2026-23632

Gogs is an open source self-hosted Git service. In version 0.13.3 and prior, the endpoint "PUT /repos/:owner/:repo/contents/*" does not require write permissions and allows access with read permission only via repoAssignment(). After passing the permission check, PutContents() invokes UpdateRepoFile(), which results in commit creation and the execution of git push. As a result, a token with read-only permission can be used to modify repository contents. This issue has been patched in versions 0.13.4 and 0.14.0+dev.

Open Source Vulnerabilities GHSA-5qhx-gwfj-6jqr

## Vulnerability Description The endpoint `PUT /repos/:owner/:repo/contents/*` does not require write permissions and allows access with **read permission only** via `repoAssignment()`. After passing the permission check, `PutContents()` invokes `UpdateRepoFile()`, which results in: * Commit creation * Execution of `git push` As a result, a token with **read-only permission** can be used to modify repository contents. --- ## Attack Prerequisites * Possession of a valid access token * Read permission on the target repository (public repository or collaborator with read access) --- ## Attack Scenario 1. The attacker accesses the target repository with a read-only token 2. The attacker sends a `PUT /contents` request to update an arbitrary file 3. The server creates a commit and performs a git push on behalf of the attacker --- ## Potential Impact * Source code tampering * Injection of backdoors * Compromise of release artifacts and distributed packages

Open Source Vulnerabilities GO-2026-4450

Gogs user can update repository content with read-only permission in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. (If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.) The additional affected modules and versions are: gogs.io/gogs before v0.13.4.