Vulnerability in Gogs

CVE-2026-25119

Gogs is an open source self-hosted Git service. Prior to 0.14.3, when ENABLE_REVERSE_PROXY_AUTHENTICATION is enabled, Gogs accepts the configured authentication header (default: X-WEBAUTH-USER) directly from client requests without validat…

EPSS: 0.006 (44.4th percentile) — read the EPSS interpretation.

Affected products

  • Gogs — versions < 0.14.3

Weakness classification (CWE)

References