{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"gogs.io/gogs","cve_ids":["CVE-2026-52810"],"ecosystem":"Go","epss":0.00427,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-wmfg-5p4h-5fw3","id":"tcs_01M5KGPA3836PY3DVC5Y71T1B6","modified_at":"2026-06-25T23:01:28.012392241Z","published_at":"2026-06-25T22:34:38Z","references":["https://osv.dev/vulnerability/GO-2026-5712","https://github.com/gogs/gogs/security/advisories/GHSA-wmfg-5p4h-5fw3","https://github.com/gogs/gogs/commit/7c9cf53aca957959bcd98b0cc987d9901b7cb184","https://github.com/gogs/gogs/pull/8331","https://github.com/gogs/gogs/releases/tag/v0.14.3"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-5712","url":"https://osv.dev/vulnerability/GO-2026-5712"}],"summary":"Gogs allows users to write to readonly repositories using receive-pack + service=git-upload-pack confusion in gogs.io/gogs"}