Gogs patches critical zero-day enabling remote code execution
A critical zero-day vulnerability in Gogs, a remote collaboration platform, has been identified, allowing authenticated attackers to execute remote code and access private repositories. The flaw, present in versions up to 0.15.0+dev, stems from default configurations like open registration and unlimited repository creation. Gogs maintainers have released a patch (0.14.3) and provided mitigation steps, urging users to upgrade immediately.
The vulnerability, discovered by Rapid7 researcher Jonah Burgess, allows an attacker with basic user privileges to compromise a Gogs server, read any repository (including private ones), steal credentials, and potentially move laterally across the network. The exploit leverages the platform's default settings – open registration (DISABLE_REGISTRATION = false) and unlimited repository creation (MAX_CREATION_LIMIT = -1) – which enable an unauthenticated user to create an account and repository, automatically becoming its owner. Enabling rebase merging further simplifies the attack chain. Following a lack of response to public disclosures, the Gogs maintainers released version 0.14.3 on June 7th to address the issue. Rapid7 recommends immediate upgrades and provides mitigation strategies, including restricting user registration and repository creation. Previous vulnerabilities, including CVE-2024-39933, CVE-2024-39932, CVE-2026-26194, and CVE-2024-39930, have also been patched by the Gogs security team, highlighting a recurring issue with default configurations.