Gogs - Information Disclosure (CVE-2026-52815)
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.
psychologyCrowdSec Analysis
CVE-2026-52815 is an unauthenticated information disclosure vulnerability in Gogs versions prior to 0.14.3. The flaw allows remote attackers to retrieve organization team details, including team IDs, names, descriptions, and permission levels, potentially aiding reconnaissance and subsequent targeted attacks.
CrowdSec has been tracking this vulnerability and its exploits since 23rd of July 2026.
CrowdSec has not observed any significant exploitation activity targeting CVE-2026-52815 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Attackers can enumerate organizations via /api/v1/repos/search, validate an organization with /api/v1/orgs/{orgname}, and then access /api/v1/orgs/{orgname}/teams without authentication. Suspicious requests to the teams endpoint returning JSON fields such as "id", "name", and "permission" may indicate exploitation of the organization team disclosure vulnerability.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2026-06-24 |
| Rule Released | 2026-07-23 |