This vulnerability is an authorisation bypass in the Watch API of Gogs. An authenticated user can watch a private repository they are not entitled to access because the check is inverted. Watching a private repository puts its commit messages, branch names, issue titles, and pull‑request details into the attacker’s activity feed. If email notifications are enabled, the attacker also receives sensitive issue and comment contents via email, exposing private repository data. The weakness is a classic access‑control flaw, classified as CWE‑863.

The affected product is Gogs, version 0.14.3 and all earlier releases. The base library was released as an open‑source self‑hosted Git service.

The CVSS score of 4.3 indicates a medium level of severity. EPSS data is not available, and the vulnerability is not listed in CISA’s KEV catalog. An attacker must first authenticate to the Gogs instance, but no further privileges are required. Once authenticated, the attacker can gain read‑only visibility of a private repository’s activity, including commit contents and discussion, which represents a moderate confidentiality breach. The likelihood of exploitation is uncertain due to missing EPSS data, but the attack path is straightforward for any user with an account.