Executive Summary

This vulnerability affects Gogs, an open source self-hosted Git service, in versions prior to 0.14.3. It allows organization team member management actions to be performed via GET requests without Cross-Site Request Forgery (CSRF) protection. If an organization owner who is logged in is tricked into visiting a specially crafted link, an attacker can add themselves or another user to the Owners team. This effectively grants the attacker organization owner–equivalent privileges.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability is severe because an attacker can gain organization owner–equivalent privileges without proper authorization. This means the attacker can fully control the organization, including managing repositories, users, and settings. Such unauthorized access can lead to data breaches, unauthorized code changes, and disruption of organizational workflows.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should upgrade Gogs to version 0.14.3 or later, where the issue is fixed.

Additionally, avoid clicking on untrusted or suspicious links while logged in as an organization owner to reduce the risk of CSRF attacks.

Useful 0 Not Useful 0