## Summary Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. ## Affected Versions Gogs (all current versions) ## Vulnerability Details ### Root Cause: Missing reqToken() middleware on org teams route group `internal/route/api/v1/api.go` lines 380-385: ```go // Org teams route group — no reqToken() middleware m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) // No auth required }, orgAssignment(true)) ``` The `orgAssignment(true)` middleware only loads the organization object — it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally: ```go func ListTeams(c *context.APIContext) { org := c.Org.Organization teams, err := database.GetTeamsByOrgID(org.ID) // Returns all teams — no c.IsLogged check, no permission check } ``` Compare with other org endpoints that correctly require authentication: ```go m.Group("/orgs/:orgname", func() { // ... other endpoints ... }, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth ``` ### Attack Chain - Attacker sends `GET /api/v1/orgs/target-org/teams` with no authentication - `orgAssignment(true)` loads the organization but does not check auth - `ListTeams()` queries all teams and returns them - Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner) ## Proof of Concept ```bash # List all teams in an organization — no authentication needed curl -s "http://TARGET:3000/api/v1/orgs/myorg/teams" | python3 -m json.tool # Expected: 200 OK with full team list # [ # { # "id": 1, # "name": "Owners", # "description": "Admin team", # "permission": "owner" # }, # { # "id": 2, # "name": "backend-devs", # "description": "Backend development team", # "permission": "write" # } # ] ``` ## Impact An unauthenticated attacker can: - Enumerate all teams within any organization, including private/internal teams - Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning - Map organizational structure and identify high-value targets (admin/owner teams) - Harvest team IDs for use in other API calls that may have weaker authorization checks ## Suggested Remediation ```go m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) }, reqToken(), orgAssignment(true)) ``` Add `reqToken()` middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, `ListTeams()` should verify the authenticated user is a member of the organization.
## Summary Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. ## Affected Versions Gogs (all current versions) ## Vulnerability Details ### Root Cause: Missing reqToken() middleware on org teams route group `internal/route/api/v1/api.go` lines 380-385: ```go // Org teams route group — no reqToken() middleware m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) // No auth required }, orgAssignment(true)) ``` The `orgAssignment(true)` middleware only loads the organization object — it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally: ```go func ListTeams(c *context.APIContext) { org := c.Org.Organization teams, err := database.GetTeamsByOrgID(org.ID) // Returns all teams — no c.IsLogged check, no permission check } ``` Compare with other org endpoints that correctly require authentication: ```go m.Group("/orgs/:orgname", func() { // ... other endpoints ... }, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth ``` ### Attack Chain - Attacker sends `GET /api/v1/orgs/target-org/teams` with no authentication - `orgAssignment(true)` loads the organization but does not check auth - `ListTeams()` queries all teams and returns them - Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner) ## Proof of Concept ```bash # List all teams in an organization — no authentication needed curl -s "http://TARGET:3000/api/v1/orgs/myorg/teams" | python3 -m json.tool # Expected: 200 OK with full team list # [ # { # "id": 1, # "name": "Owners", # "description": "Admin team", # "permission": "owner" # }, # { # "id": 2, # "name": "backend-devs", # "description": "Backend development team", # "permission": "write" # } # ] ``` ## Impact An unauthenticated attacker can: - Enumerate all teams within any organization, including private/internal teams - Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning - Map organizational structure and identify high-value targets (admin/owner teams) - Harvest team IDs for use in other API calls that may have weaker authorization checks ## Suggested Remediation ```go m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) }, reqToken(), orgAssignment(true)) ``` Add `reqToken()` middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, `ListTeams()` should verify the authenticated user is a member of the organization.
Update gogs.io/gogs to 0.14.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanGogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API affects gogs.io/gogs (go). Severity is medium. ## Summary Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. ## Affected Versions Gogs (all current versions) ## Vulnerability Details ### Root Cause: Missing reqToken() middleware on org teams route group `internal/route/api/v1/api.go` lines 380-385: ```go // Org teams route group — no reqToken() middleware m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) // No auth required }, orgAssignment(true)) ``` The `orgAssignment(true)` middleware only loads the organization object — it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally: ```go func ListTeams(c *context.APIContext) { org := c.Org.Organization teams, err := database.GetTeamsByOrgID(org.ID) // Returns all teams — no c.IsLogged check, no permission check } ``` Compare with other org endpoints that correctly require authentication: ```go m.Group("/orgs/:orgname", func() { // ... other endpoints ... }, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth ``` ### Attack Chain - Attacker sends `GET /api/v1/orgs/target-org/teams` with no authentication - `orgAssignment(true)` loads the organization but does not check auth - `ListTeams()` queries all teams and returns them - Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner) ## Proof of Concept ```bash # List all teams in an organization — no authentication needed curl -s "http://TARGET:3000/api/v1/orgs/myorg/teams" | python3 -m json.tool # Expected: 200 OK with full team list # [ # { # "id": 1, # "name": "Owners", # "description": "Admin team", # "permission": "owner" # }, # { # "id": 2, # "name": "backend-devs", # "description": "Backend development team", # "permission": "write" # } # ] ``` ## Impact An unauthenticated attacker can: - Enumerate all teams within any organization, including private/internal teams - Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning - Map organizational structure and identify high-value targets (admin/owner teams) - Harvest team IDs for use in other API calls that may have weaker authorization checks ## Suggested Remediation ```go m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) }, reqToken(), orgAssignment(true)) ``` Add `reqToken()` middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, `ListTeams()` should verify the authenticated user is a member of the organization.
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| gogs.io/gogsgo | <0.14.3 | 0.14.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL GuardUpdate gogs.io/gogs to 0.14.3 if you use the affected versions. Test the change in a non-production environment first.
Local check
hol-guard supply-chain scanGogs Vulnerable to Unauthenticated Organization Teams Information Disclosure via API affects gogs.io/gogs (go). Severity is medium. ## Summary Gogs has an unauthenticated information disclosure vulnerability. The `GET /api/v1/orgs/:orgname/teams` endpoint at `internal/route/api/v1/org_team.go:8` returns all teams for any organization without requiring authentication. The route group at `internal/route/api/v1/api.go:380-385` lacks the `reqToken()` middleware, and the `listTeams()` handler performs no authentication check, exposing team IDs, names, descriptions, and permission levels to any unauthenticated caller. ## Affected Versions Gogs (all current versions) ## Vulnerability Details ### Root Cause: Missing reqToken() middleware on org teams route group `internal/route/api/v1/api.go` lines 380-385: ```go // Org teams route group — no reqToken() middleware m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) // No auth required }, orgAssignment(true)) ``` The `orgAssignment(true)` middleware only loads the organization object — it performs no authentication. The `listTeams()` handler at `org_team.go:8` returns all teams unconditionally: ```go func ListTeams(c *context.APIContext) { org := c.Org.Organization teams, err := database.GetTeamsByOrgID(org.ID) // Returns all teams — no c.IsLogged check, no permission check } ``` Compare with other org endpoints that correctly require authentication: ```go m.Group("/orgs/:orgname", func() { // ... other endpoints ... }, reqToken(), orgAssignment(true, true)) // reqToken() enforces auth ``` ### Attack Chain - Attacker sends `GET /api/v1/orgs/target-org/teams` with no authentication - `orgAssignment(true)` loads the organization but does not check auth - `ListTeams()` queries all teams and returns them - Response includes team IDs, names, descriptions, and permission levels (read/write/admin/owner) ## Proof of Concept ```bash # List all teams in an organization — no authentication needed curl -s "http://TARGET:3000/api/v1/orgs/myorg/teams" | python3 -m json.tool # Expected: 200 OK with full team list # [ # { # "id": 1, # "name": "Owners", # "description": "Admin team", # "permission": "owner" # }, # { # "id": 2, # "name": "backend-devs", # "description": "Backend development team", # "permission": "write" # } # ] ``` ## Impact An unauthenticated attacker can: - Enumerate all teams within any organization, including private/internal teams - Discover team permission levels (read/write/admin/owner), aiding privilege escalation planning - Map organizational structure and identify high-value targets (admin/owner teams) - Harvest team IDs for use in other API calls that may have weaker authorization checks ## Suggested Remediation ```go m.Group("/:orgname", func() { m.Get("/teams", org.ListTeams) }, reqToken(), orgAssignment(true)) ``` Add `reqToken()` middleware to the org teams route group, consistent with other authenticated org endpoints. Additionally, `ListTeams()` should verify the authenticated user is a member of the organization.
AI coding agents often install or upgrade packages automatically in go. A medium vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|---|---|
| gogs.io/gogsgo | <0.14.3 | 0.14.3 |
Fixed versions are reported by the source feed; confirm compatibility before updating.
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard