Gogs EUVD-2026-39072

Exploitation requires the attacker to already hold admin collaborator access (AccessModeAdmin=3) explicitly granted by the repository owner - Gogs installations with no admin-level collaborators are not at risk from this vulnerability. The attacker must be authenticated to the Gogs instance and must use the web interface route (/settings/collaboration/access_mode); the API endpoint is unaffected in all versions due to its use of ParseAccessMode(). Exploitation is scoped to individual repositories where the attacker has been invited as an admin collaborator and does not provide instance-wide access or affect other repositories. What limits exploitation: the attacker cannot self-grant initial collaborator access through this vulnerability, making it entirely dependent on a prior trust decision by the repository owner.

No NVD CVSS score is available at time of analysis; my independently assessed score of CVSS 3.1 8.8 (High) reflects network exploitability with a low-privilege prerequisite. The critical limiting factor is that exploitation requires the attacker to already hold an explicitly granted admin collaborator role on the target repository - it is not a zero-privilege or unauthenticated attack. However, once that prerequisite is satisfied, exploitation is mechanically trivial: a single crafted HTTP POST with mode=4 is sufficient, with no additional attack complexity. The persistence of escalated privileges via the access table update is a significant risk amplifier, as it survives session termination. No EPSS score or CISA KEV listing is present in the available intelligence, indicating no confirmed widespread active exploitation at time of analysis. The advisory provides step-by-step reproduction instructions, which lower the skill threshold considerably for any attacker already holding admin access to a repository. The fix is more architecturally comprehensive than a one-line correction - it redesigns the function signature to enforce actor-bound privilege grants - suggesting the original code had a broader design assumption flaw beyond the single boundary check.

An attacker who has been legitimately granted admin collaborator access (mode=3) to a private Gogs repository authenticates to the instance and sends a single crafted HTTP POST to /{owner}/{repo}/settings/collaboration/access_mode?uid={their_own_uid}&mode=4. The faulty boundary check passes mode=4 as valid, the database writes owner-level access to both the collaboration record and the persistent access table, and the attacker immediately gains access to the repository Danger Zone - enabling them to delete the repository or transfer ownership to an account they control. No special tooling beyond a browser or curl is required.