CVE-2026-123012

Quick assessment

Copy summary Copy citation

Affected

Gogs Gogs

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Gogs 0.14.3 中，位于 的 Git 智能 HTTP 授权层存在一个漏洞，允许在仅授予读取权限的情况下执行推送操作。该漏洞不同于 CVE-2026-52810，其成因在于对动词（verb）的校验是否区分大小写存在不一致。

CVE-2026-123012 affects Gogs Gogs. No confirmed in-the-wild exploitation; assess based on exposure. 在 Gogs 0.14.3 中，位于 的 Git 智能 HTTP 授权层存在一个漏洞，允许在仅授予读取权限的情况下执行推送操作。该漏洞不同于 CVE-2026-52810，其成因在于对动词（verb）的校验是否区分大小写存在不一致。 CVE-2026-123012 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2026-123012

I. Basic Information for CVE-2026-123012

Affected Products

II. Public POCs for CVE-2026-123012

III. Intelligence Information for CVE-2026-123012

Vendor Advisories for CVE-2026-123012 (1)

• 🔗 Write to readonly repositories using receive-pack + service=git-upload-pack confusion · Advisory · gogs/gogs · GitHub Read full article related

Other References for CVE-2026-123012 (2)

• https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L415-L418 product
• https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L64-L68 product

• https://www.cve.org/CVERecord?id=CVE-2026-123012

IV. Related Vulnerabilities