Gogs 0.5.5 through 0.12.2 is susceptible to authenticated remote code execution via the git hooks functionality. There can be a privilege escalation if access to this feature is granted to a user who does not have administrative privileges. NOTE: Since this is mentioned in the documentation but not in the UI, it could be considered a "product UI does not warn user of unsafe actions" issue.
id: CVE-2020-15867
info:
name: Gogs 0.5.5 - 0.12.2 - Remote Code Execution
author: theamanrawat
...