{"id":"CVE-2026-123012","published":"2026-11-05T05:18:36.790","lastModified":"2026-11-05T05:18:36.790","description":"In Gogs 0.14.3, the Git Smart HTTP authorization layer in internal/route/repo/http.go allows a push when only read access was intended, a different vulnerability than CVE-2026-52810. This occurs because of inconsistency about whether a verb is checked in a case-sensitive manner.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-178"],"vendors":[],"products":[],"references":[{"url":"https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L415-L418","tags":[]},{"url":"https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L64-L68","tags":[]},{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3","tags":[]}],"exploitRefs":[{"url":"https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L415-L418","tags":[]},{"url":"https://github.com/gogs/gogs/blob/3ba8aca90e17e5410b7e8b227c9f29256ac3e875/internal/route/repo/http.go#L64-L68","tags":[]},{"url":"https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3","tags":[]}],"hasPoc":true,"ai":null}