Default Gogs Installs Expose Private Repos to Anyone
Gogs’s weak point is not just authenticated access. On default installs, open registration lets anyone make an account first, so an argument-injection flaw becomes effectively Internet-exploitable and can expose private repositories, credentials, and source integrity.
The bug affects all releases up to and including 0.14.2 and 0.15.0+dev, and Gogs has shipped 0.14.3 to fix it. Rapid7 says a default-configured instance lets an attacker create a user and repository, then trigger the flaw without help from another user; the impact can include reading private repos, stealing credentials, moving laterally, and altering hosted code.
This is the kind of bug that turns a collaboration server into a trust break for the whole codebase, not just one account. The same risk pattern shows up anywhere open registration and self-service workspaces sit in front of a bug that was assumed to need a real user first.
Gogs has patched a critical security zero-day flaw that can allow attackers to compromise Internet-facing instances and access any repositories (including private ones).