~ / search / GHSA-4c7m-vv47-7c69

GHSA-4c7m-vv47-7c69

Insecure Permissions in Gogs

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-14958

Packages

EcosystemPackageAffectedFixed in
Go gogs.io/gogs < 0.12.0 0.12.0

Details

As written in the advisory (Markdown source, shown as plain text).

In Gogs 0.11.91, MakeEmailPrimary in models/user_mail.go lacks a "not the owner of the email" check.

References

External links from the advisory. They lead to third-party sites.