CVE-2026-25119— Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-25119
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers
Source: NVD (National Vulnerability Database)
Vulnerability Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication. This vulnerability is fixed in 0.14.3.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用欺骗进行的认证绕过
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-25119
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-25119
请登录查看更多情报信息。
Other References for CVE-2026-25119 (4)
Same Patch Batch · gogs · 2026-06-24 · 24 CVEs total
| CVE-2026-52813 | 10.0 CRITICAL | Gogs: Path Traversal in organization name results in RCE through Git hooks |
| CVE-2026-52806 | 9.9 CRITICAL | Gogs: RCE via git rebase --exec argument injection in pull request merge |
| CVE-2026-52798 | 8.9 HIGH | Gogs: Stored XSS in `.ipynb` Preview |
| CVE-2026-52800 | 8.8 HIGH | Gogs: CSRF Leading to Organization Owner Takeover |
| CVE-2026-52805 | 8.7 HIGH | Gogs: Migration Redirect Bypass Leads to Internal Repository Theft |
| CVE-2026-52797 | 8.5 HIGH | Gogs: Overwriting critical files results in a denial of service |
| CVE-2026-47267 | 8.3 HIGH | Gogs: SSRF in webhook deliveries |
| CVE-2026-52801 | 8.1 HIGH | Gogs: Ability to import local repositories via Mirror Settings |
| CVE-2026-52799 | 7.5 HIGH | Gogs: Missing Authorization in Attachment Download |
| CVE-2026-52808 | 7.1 HIGH | Gogs: Write-level collaborators can mutate admin-only repository settings via API |
| CVE-2026-52809 | 6.8 MEDIUM | Gogs: Password-reset tokens use account-activation lifetime, ignoring RESET_PASSWORD_CODE_ |
| CVE-2026-52802 | 5.4 MEDIUM | Gogs: Open Redirect via redirect_to in Gogs |
| CVE-2025-64719 | 4.9 MEDIUM | Gogs: Denial of Service in repository/wiki file listing web pages |
| CVE-2026-52795 | 4.3 MEDIUM | Gogs: Authorization Bypass in Watch API allows any user to monitor private repository acti |
| CVE-2026-52796 | 3.5 LOW | Gogs: DoS in rendering issue index pattern |
| CVE-2026-52807 | Gogs: DOM-based XSS via Milestone Name on New Issue Page | |
| CVE-2026-52816 | Gogs: Unauthenticated Jupyter Notebook (ipynb) Sanitizer allows arbitrary data: URIs leadi | |
| CVE-2026-52810 | Gogs: Write to readonly repositories using receive-pack + service=git-upload-pack confusio | |
| CVE-2026-52814 | Gogs: Unauthenticated Asymmetric Denial of Service (DoS) via SSH Handshake Stall (File Des | |
| CVE-2026-52811 | Gogs: UploadRepoFiles writes outside repo working tree via committed parent sym |
Showing top 20 of 24 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: gogs
- CVE-2026-52797
Gogs: Overwriting critical files results in a denial of serv - CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE thr - CVE-2026-52812
Gogs: LFS dedupe path leaks private repo content across tena - CVE-2026-52811
Gogs: UploadRepoFiles writes outside repo working tree via c - CVE-2026-52810
Gogs: Write to readonly repositories using receive-pack + se
Same vendor: gogs
- CVE-2026-52797
Gogs: Overwriting critical files results in a denial of serv - CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE thr - CVE-2026-52812
Gogs: LFS dedupe path leaks private repo content across tena - CVE-2026-52811
Gogs: UploadRepoFiles writes outside repo working tree via c - CVE-2026-52810
Gogs: Write to readonly repositories using receive-pack + se
Same weakness: CWE-290
- CVE-2026-47381
NocoDB: Cross-Workspace Integration Use in Connection Test - CVE-2026-54308
n8n: Missing Token Validation on Microsoft Agent 365 Trigger - CVE-2026-56357
n8n - Webhook Forgery via Missing HMAC-SHA256 Signature Veri - CVE-2026-49468
LiteLLM: Authentication Bypass via Host Header Injection - CVE-2026-49231
Apache APISIX: Identity spoofing issue in APISIX opa plugin
V. Comments for CVE-2026-25119
No comments yet