CVE-2026-52802: Gogs has an Open Redirect via redirect_to

June 23, 2026

An open redirect vulnerability exists in Gogs where attacker-controlled redirect_to parameters can bypass validation, allowing redirection to arbitrary external sites.

References

github.com/advisories/GHSA-xxhq-69mf-w8cr
github.com/gogs/gogs/commit/c5da9631dc75f692f313373ae229c4d47ba6517f
github.com/gogs/gogs/pull/8322
github.com/gogs/gogs/releases/tag/v0.14.3
github.com/gogs/gogs/security/advisories/GHSA-xxhq-69mf-w8cr
nvd.nist.gov/vuln/detail/CVE-2026-52802

Code Behaviors & Features

Detect and mitigate CVE-2026-52802 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →