The vulnerability allows a user possessing only read‑only permissions to modify the contents of a repository by sending a "PUT /repos/:owner/:repo/contents/*" request. After passing a lax permission check, the backend commits and pushes the changes, thereby granting an attacker the ability to alter, add or delete files in the target repository. This grants the attacker significant impact on confidentiality and integrity of the repository content without requiring elevated privileges.

The issue afflicts Gogs versions 0.13.3 and earlier. The fix is included in versions 0.13.4 and 0.14.0+, and later developments. Users running any older version should review their deployment and confirm the vulnerability applies.

The CVSS score of 6.5 indicates medium severity, while the EPSS score of less than 1% points to a very low exploitation probability at the time of analysis. The vulnerability is not listed in the CISA KEV catalog, suggesting no confirmed widespread exploitation yet. The likely attack vector is a compromised read‑only token, a credential that an attacker may obtain through phishing or credential reuse. If such a token is used by an attacker to call the vulnerable endpoint, they can modify repository contents, potentially injecting malicious code or disrupting service.