Gogs is an open source self-hosted Git service. Prior to version 0.14.3, the smart HTTP implementation authorizes POST requests to the “/git-receive-pack” endpoint based on the client‑supplied service query string. When the query string contains ?service=git-upload-pack, the server evaluates the request as read‑only access yet still routes the call to git receive‑pack, which performs a write operation. Consequently, an authenticated user with only read permissions can push arbitrary commits to otherwise be immutable, compromising repository integrity.

The flaw exists in all Gogs releases prior to 0.14.3. Any installation that has not upgraded beyond that version is susceptible, regardless of the number of users or the size of the deployment.

The CVSS score of 7.1 indicates a moderate to high severity vulnerability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. An attacker can exploit the issue by sending a POST request to a host‑based Gogs instance using the service query string ?service=git-upload-pack on the /git-receive-pack endpoint. The attack requires network connectivity to the server and valid read credentials. Based on the description, the likely attack vector is remote over HTTP, and the exploit is straightforward for anyone with read access.