Technical impact
The vulnerability allows the Gogs API to accept access tokens in URL query parameters such as token and access_token. Tokens included in URLs can be recorded in web server logs, stored in browser history, and transmitted via HTTP referrer headers. An individual with access to these logs or the ability to intercept network traffic could retrieve valid tokens, granting unauthorized access to repositories and potentially sensitive data. Though the flaw does not provide direct code execution or server compromise, it facilitates credential disclosure and an elevated risk of account take‑over.
Affected Systems
The issue affects all versions of Gogs prior to 0.14.2. The vendor product is Gogs, an open‑source self‑hosted Git service, and the vulnerable components are the API endpoints that parse URL query parameters for authentication tokens.
Risk and Exploitability
The CVSS score of 6.9 indicates a medium severity, while the EPSS score of less than 1% suggests very low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog, implying no confirmed public exploits. Attackers could exploit the flaw by crafting URLs that include tokens or by intercepting traffic that contains such URLs. This requires either access to server logs or the ability to observe HTTP requests, making the attack vector likely to be either local or remote through traffic interception.
Github GHSA