CVE-2026-52815

MEDIUM NUCLEI

Gogs: Unauthenticated Organization Teams Information Disclosure via API

Title source: cna
STIX 2.1

Exploitation Summary

CVE-2026-52815 has a Nuclei detection template available — see the Nuclei card below for the Shodan/FOFA recon queries.

Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.

Nuclei Templates (1)

Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure
LOWVERIFIEDby 0x_Akoko
Shodan: http.title:"Gogs"
FOFA: title="Gogs"

References (1)

Core 1
Core References

Scores

CVSS v4 5.5
EPSS 0.0110
EPSS Percentile 62.4%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-200
Status published
Products (2)
gogs/gogs < 0.14.3
gogs.io/gogs 0 - 0.14.3Go
Published Jun 24, 2026
Tracked Since Jun 25, 2026