A default Gogs install gives an attacker the whole forge, not one repo. The standard check of “only trusted repo owners can rebase” misses that open registration and repo creation let a stranger create their own account, then reach server-side command execution through rebase merging.
Rapid7 has now published the technical details and mapped the bug to CVE-2026-20182. It affects Gogs 0.14.2 and 0.15.0+dev, with no patch at publication, and the server process can then read private repositories, steal passwords, API tokens, SSH keys, and 2FA secrets, and tamper with hosted code.
That makes every still-running default instance a cross-tenant exposure, not a single-project bug. The overdue KEV deadline turns a disclosed flaw into an immediate patch issue for internet-facing Gogs servers.