Gogs EUVD-2026-101576

Requires that a victim click an attacker-crafted link pointing at the /redirect endpoint (or another post-action redirect flow) on a trusted Gogs instance running a version prior to 0.15.0+dev. The specific trigger is a backslash (literal '\', or percent-encoded %5C/%5c) or whitespace (tab/CR/LF) in the redirect target, which the pre-patch internal/urlx/urlx.go IsSameSite normalizes away while cmd/gogs/internal/web/web.go getRedirect emits the original raw value in the Location header. No authentication is needed (PR:N), and no special server configuration is required since /redirect is reachable by default. The principal limiting factor is user interaction (UI:P): the attack is pure social-engineering/phishing and cannot redirect a victim who does not click the malicious link; it also yields no access to the Gogs server itself.

This is a genuine but modest-severity issue, correctly rated medium (CVSS 4.0 base 5.3). The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P) shows a network-reachable, low-complexity flaw requiring no privileges, consistent with the description's 'unauthenticated attacker' and the /redirect endpoint being pre-auth. The impact metrics tell the real story: no impact to the vulnerable Gogs system itself (VC:N/VI:N/VA:N) and only low confidentiality/integrity impact on a subsequent system (SC:L/SI:L) - i.e., the victim's browser/session, which is exactly what an open redirect (CWE-601) does. Crucially, UI:P (passive user interaction) means a victim must click an attacker-supplied link on the trusted Gogs domain, so this is not self-propagating. No EPSS score, no CISA KEV listing, and no public POC were supplied; per precision rules this is 'no public exploit identified at time of analysis.' No SSVC decision data was provided. Bottom line: a legitimate phishing-enablement bug worth patching, but not an urgent priority - it grants no code execution, no data access on the server, and depends on social engineering. There are no conflicting signals: the CVSS vector, description, and patch evidence all align.

An attacker crafts a URL such as https://trusted-gogs.example.com/redirect?... with a backslash-containing target that IsSameSite normalizes as same-site but the Location header emits verbatim; a victim who already trusts the Gogs domain clicks it and the browser interprets the raw value as a scheme-relative external URL, landing them on an attacker-controlled phishing page. No public POC was provided, but the GitHub security advisory and patch diff fully describe the normalization-mismatch technique. Because UI:P/AC:L apply, exploitation is easy but hinges on the victim clicking the crafted link.