security2 distinct publishers
CVE-2026-52806 turns a Gogs branch name into command execution as the git user
Rapid7 scored it 9.9 and Gogs shipped 0.14.3 on June 7, 2026. The reason it rates that high is configuration: open registration and unlimited repository creation let a stranger own the repo they attack from.
Reality
- Evidence84
- Adoption52
- Hype gap+14
- Incentives72