# CVE-2026-52815: Gogs - Information Disclosure

> Live exploitation tracking for CVE-2026-52815 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2026-52815

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 5.5
- **Public exploit available:** Yes
- **Affected products:** Gogs
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** scm, go

## Description

Gogs is an open source self-hosted Git service. Prior to 0.14.3, Gogs has an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint at internal/route/api/v1/org_team.go:8 returns all teams for any organization without requiring authentication. The route group at internal/route/api/v1/api.go:380-385 lacks the reqToken() middleware, and the listTeams() handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. This vulnerability is fixed in 0.14.3.

## CrowdSec analysis

[CVE-2026-52815](https://euvd.enisa.europa.eu/vulnerability/CVE-2026-52815) is an unauthenticated information disclosure vulnerability in Gogs versions prior to 0.14.3. The flaw allows remote attackers to retrieve organization team details, including team IDs, names, descriptions, and permission levels, potentially aiding reconnaissance and subsequent targeted attacks.

CrowdSec has been tracking this vulnerability and its exploits since 23rd of July 2026.

CrowdSec has not observed any significant exploitation activity targeting CVE-2026-52815 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers can enumerate organizations via `/api/v1/repos/search`, validate an organization with `/api/v1/orgs/{orgname}`, and then access `/api/v1/orgs/{orgname}/teams` without authentication. Suspicious requests to the teams endpoint returning JSON fields such as `"id"`, `"name"`, and `"permission"` may indicate exploitation of the organization team disclosure vulnerability.

## Timeline

- 2026-06-24: CVE Published. CVE-2026-52815 is published to NVD.
- 2026-07-23: Rule Released. CrowdSec releases a rule to detect CVE-2026-52815 exploitation attempts against the CrowdSec Network.

## References

- https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-52815.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2026-52815) follows observed exploitation activity for CVE-2026-52815. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.