Live Exposure Defense: From CVE to Confirmed Exposure in 12 Hours – See more

Back
New CVE Detected

CVE-2026-52799 – Unauthenticated Attachment Disclosure – Gogs prior to 0.14.3

Be the first to know when new zero-days emerge:

Subscribe to Email Alerts
Subscribe to RSS Feed

Summary

CVE-2026-52799 is a missing authorization vulnerability in Gogs, an open-source self-hosted Git service, affecting all versions prior to 0.14.3. The GET /attachments/:uuid endpoint serves raw attachment files without verifying whether the requester holds view permission for the associated Issue, Comment, Release, or repository, allowing an attacker with knowledge of an attachment UUID to download files from private repositories. With a CVSS v3.1 score of 7.5 (High), the vulnerability carries no authentication or user-interaction requirement and results in a high confidentiality impact.

Technical details

  • Root cause: The attachment download handler in internal/cmd/web.go retrieves attachment records by UUID alone and returns the corresponding file without performing any authorization check. The underlying database function in internal/database/attachment.go performs no validation tied to repository visibility or user permissions (CWE-862: Missing Authorization; CWE-639: Authorization Bypass Through User-Controlled Key).
  • Trigger conditions: When REQUIRE_SIGNIN_VIEW = false (the default in many self-hosted deployments), fully unauthenticated requests are sufficient. When sign-in is required, any logged-in user — even without repository access — can exploit the endpoint, as repository-level permissions are never enforced.
  • Attack vector: Remote, network-accessible HTTP request to GET /attachments/:uuid with no special privileges or user interaction; the only prerequisite is knowledge of a target attachment’s UUID.
  • Impact: Unauthorized disclosure of attachment files from private repositories, potentially including credentials, cryptographic keys, internal documents, unpublished source code, or personal data.

Affected software

  • Gogs all versions prior to 0.14.3 (i.e., ≤ 0.14.2)

Severity

  • CVSS v3.1 Base Score: 7.5 (High)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Mitigation and recommended actions

  • Immediate – upgrade: Update Gogs to version 0.14.3, which introduces proper authorization verification on the GET /attachments/:uuid endpoint before serving any file.
  • If immediate patching is not possible:
    • Set REQUIRE_SIGNIN_VIEW = true in app.ini to prevent unauthenticated access to all Gogs endpoints, raising the bar for exploitation.
    • Apply network-level controls (firewall rules, reverse-proxy access restrictions) to limit exposure of the Gogs instance to trusted networks only, preventing unauthenticated internet-facing access.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report

How IONIX’s External Exposure Management Platform Detects and Validates
Zero-Days to Shrink MTTR

1

Map your entire attack surface (continously)

IONIX uses multi-factor discovery methods, including DNS analysis, certificate mapping, metadata inspection, and more, to automatically map every internet-facing asset across your environment. This includes cloud instances, third-party platforms, shadow IT, and even forgotten infrastructure that traditional tools miss.

2

Monitor for new CVEs

Dozens of threat intel feeds using agentic technology are continuously analyzed to detect the appearance of proof-of-concept code, exploit kits, and indicators of active targeting. IONIX goes further by applying AI to proactively evaluate whether emerging vulnerabilities are likely to be exploited, even before PoCs go public.

3

Identify Potential External Exposures

Not all CVEs matter. IONIX filters vulnerabilities by asking attacker-centric questions: Can it be reached from the internet? Does it require authentication? Is it being exploited in the wild? This dramatically reduces noise and focuses teams on threats that can actually be weaponized.

4

Create Safe, Scalable Exploit Validations

IONIX transforms real-world PoCs into safe, non-intrusive test payloads that can be run in production environments without disruption. These simulations are precisely targeted to the systems that are vulnerable, ensuring rapid validation without unnecessary load.

5

Execute Exploit Validations

By combining context about software stack, versioning, exposure status, and reachability, IONIX ensures that only the right payloads are executed against the right assets, maximizing efficiency and minimizing risk.

6

Drive Fast and Actionable Remediation

Results are routed through integrations with ticketing, SOAR, and SIEM tools. Issues are written in plain language, bundled into remediation clusters, and prioritized based on asset criticality, exploitability, and blast radius. This shortens mean time to remediation (MTTR) and empowers teams to act with confidence.

Are you exposed?

Get a free report of your organization’s exposure to this CVE and threat

  • Mapping of all Assets with this Technology
  • Identification of potentially exposed assets to this CVE
  • Confirmation of verified exploitable assets
Get Exposure Report
Close

Subscribe to Threat Center RSS

Copy/paste the link below into your preferred RSS reader or follow these instructions to subscribe to Slack alerts.

Open RSS feedSlack setup instructions

Close

Get Real-Time CVE Alerts to Your Email

Be the first to know when new zero-days emerge