High severity · published Jun 24, 2026
CVE-2026-25119
Gogs: Authentication Bypass via Unvalidated Reverse Proxy Headers
7.7
CVSS
0.9%
EPSS
No
On KEV
Description
Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validating that the request originated from a trusted reverse proxy. Any remote attacker who can reach the Gogs service can forge this header to impersonate any user or trigger automatic account creation, completely bypassing authentication. This vulnerability is fixed in 0.14.3.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GO
gogs · gogs
< 0.14.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-25119
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-25119
github.com
https://github.com/gogs/gogs/commit/0089c4c8e5b8d99eb6e5c8727f8f40d765f1f58a
github.com
https://github.com/gogs/gogs/pull/8264
github.com
https://github.com/gogs/gogs/releases/tag/v0.14.3
github.com
https://github.com/gogs/gogs/security/advisories/GHSA-w6j9-vw59-27wv
More from gogs
8.8
CVE-2025-8110
File overwrite in file update API in Gogs
10.0
CVE-2026-52813
Gogs: Path Traversal in organization name results in RCE through Git hooks
9.9
CVE-2026-52806
Gogs: RCE via git rebase --exec argument injection in pull request merge
9.9
CVE-2024-39932
Gogs through 0.13.0 allows argument injection during the previewing of changes
9.9
CVE-2024-39931
Gogs through 0.13.0 allows deletion of internal files