Four actions, all inside the attacker's own account: sign up, create a repository, flip one setting in it, open a pull request [3]. The flaw sits in the last step. According to runZero, Gogs hands the pull request's source branch name straight to `git rebase` without a `--` delimiter to mark the end of options [3], so a branch name beginning with --exec is parsed as a flag and its value runs as a command during the rebase merge [2].
Version 0.14.2 is the awkward part. runZero's own timeline lists 0.14.2 as the fix for CVE-2026-25921, the March 2026 cross-repository LFS overwrite scored 9.3 and reachable without authentication [14]. Rapid7 lists 0.14.2 as confirmed vulnerable to 52806. Anyone who upgraded in March to clear the LFS bug is sitting on the June one, and 0.14.3 is the first build that satisfies both [1].
Execution lands as the Gogs process user, which on Docker installs is git at UID 1000 and on binary installs is whatever account the administrator chose [16]. Every repository on the instance then sits under one REPOSITORY_ROOT with no OS-level isolation between them [9]. That is the same shape as the LFS flaw, where all objects shared a single location without per-repository separation [14]; in both cases one tenant gets leverage over another tenant's data because nothing separates them on disk [5].
This is the third separately tracked Gogs flaw in the seven months from December 2025 to June 2026 [2]. The first, CVE-2025-8110, was an authenticated arbitrary file overwrite scored 7.8 in versions 0.13.3 and earlier, and runZero notes evidence of exploitation in the wild for it [15]. That is the closest thing available to a base rate for attacker interest in this software.
The 1,141 figure is a floor. It counts hosts whose Gogs sign-in title is visible to Shodan, and Rapid7 says the real install base is much larger because most instances sit behind VPNs or on internal networks [7]; a project carrying roughly 50,000 GitHub stars and 5,000 forks is not deployed 1,141 times [11][4]. For instances that cannot restart on 0.14.3 quickly, runZero's configuration advice still applies: DISABLE_REGISTRATION = true, MAX_CREATION_LIMIT = 0, and no internet path to the web interface [13]. Rapid7's own triage line is the account count. Any Gogs instance with more than one user is effectively multi-tenant, and on those, a single member holds everything the git user can read [10].
