Gogs is an open‑source self‑hosted Git service. Prior to version 0.14.3, three API endpoints—PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync—were protected by a write‑level check rather than an admin check. While the web UI actions for these settings require admin access, the API endpoints permitted any collaborator with write permission to invoke them. Consequently a write collaborator can disable the native issue tracker or wiki, inject attacker‑controlled external tracker or wiki URLs that redirect all repository visitors, or trigger mirror sync—all of which they are not authorized to do. The vulnerability is fixed in 0.14.3.

The flaw impacts all Gogs releases prior to 0.14.3. Any instance of the self‑hosted Git server running an earlier version with repositories that have write collaborators is vulnerable. The vulnerability is identified as aWE‑269) and a missing authorization check (CWE‑863).

The vulnerability scores a moderate severity CVSS of 7.1. No EPSS score is currently available and the issue is not listed in CISA’s KEV catalog, suggesting that exploitation has not been widely observed. The likely attack vector is authenticated API calls; an attacker must first be a write‑level collaborator the offender has legitimate write permissions, they can trivially elevate their influence over repository settings unless mitigated by an updated version or manual controls.