Description
routes/api/v1/api.go in Gogs 0.11.86 lacks permission checks for routes: deploy keys, collaborators, and hooks.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | gogs.io/gogs | < 0.11.91 | 0.11.91 | GHSA-5r2v-6gm6-vpvh |
Critical · 9.8
CVE-2019-14544
EUVD-2021-0961GHSA-5r2v-6gm6-vpvhGO-2022-0797
Insecure Permissions in Gogs
Published Aug 2, 2019 · Updated Aug 5, 2024 · Assigned by mitre