Gogs CVE-2026-52795

Exploitation requires a valid authenticated Gogs account on the target instance - no administrative privileges or elevated roles are needed (CVSS PR:L confirms low-privilege access is sufficient). The attacker must also know or correctly guess the owner username and repository name of the target private repository, as there is no unauthenticated repository enumeration implied by the description. The most sensitive form of disclosure - full issue and comment content - additionally requires that the Gogs administrator has enabled email notifications, which is a configurable rather than default-on setting. What limits exploitation: authentication is mandatory (unauthenticated external attackers cannot exploit this), repository name must be known or guessed (requires prior reconnaissance or insider knowledge), and email-level disclosure depends on a specific server configuration. Dashboard-level metadata disclosure (commit messages, branch names, issue titles) occurs without any email configuration requirement.

The NVD CVSS 3.1 score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N is consistent with the description: network-accessible, low complexity, requiring only a valid account, with limited confidentiality impact and no integrity or availability consequences. This CVE is not in the CISA KEV catalog and no standalone POC exploit code has been identified; however, the published upstream commit diff is a one-line change that makes reproduction trivially obvious to any authenticated user reading the advisory. The practical risk is elevated for multi-tenant or organizational Gogs deployments where private repository metadata - commit messages, branch names, issue and PR titles - contains sensitive business, security, or personnel information. Real-world impact depends heavily on whether email notifications are enabled, as that escalates disclosure from metadata to full issue and comment content. EPSS score was not provided in available data. No conflicts between the CVSS vector and the description were identified.

An authenticated Gogs user with a valid low-privilege account but no access to a target private repository sends a Watch subscription API request (e.g., PUT /api/v1/repos/{owner}/{private-repo}/subscription) after learning the repository name through enumeration or insider knowledge. The inverted access check grants the watch rather than blocking it, and the attacker's activity dashboard begins surfacing commit messages, branch names, issue titles, and PR details. If the instance has email notifications enabled, the attacker additionally receives emails containing full issue descriptions and comment threads from the private repository.