CVE-2026-52808

Summary Three API endpoints — PATCH /api/v1/repos/:owner/:repo/issue-tracker, PATCH /api/v1/repos/:owner/:repo/wiki, and POST /api/v1/repos/:owner/:repo/mirror-sync — are gated by reqRepoWriter() rather than reqRepoAdmin(). The equivalent operations in the web UI sit behind reqRepoAdmin, which requires AccessMode >= AccessModeAdmin. A write-level collaborator (who has AccessMode == AccessModeWrite < AccessModeAdmin) can therefore call these API endpoints directly to disable the native issue tracker or wiki, inject attacker-controlled external tracker/wiki URLs that redirect all repository visitors, or trigger mirror sync — none of which they are authorized to do. Severity High (CVSS 3.1: 7.1) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L - Attack Vector: Network — the API endpoints are reachable over HTTP/S. - Attack Complexity: Low — a single API call is sufficient; no chaining or race condition required. - Privileges Required: Low — only write-level collaborator access to the targeted repository is needed. The attacker does not need repo-admin or site-admin privileges. - User Interaction: None — the attacker acts unilaterally. - Scope: Unchanged — the impact is contained to the targeted repository's settings and its visitors. - Confidentiality Impact: None — the attacker does not read confidential data directly. - Integrity Impact: High — the attacker permanently mutates repository configuration, including injecting an external URL that redirects all visitors who click the Issues or Wiki tabs to an attacker-controlled site. - Availability Impact: Low — disabling the native issue tracker or wiki reduces the availability of those features for all repository participants. Affected component - internal/route/api/v1/api.go — route registration (lines 365–367) - internal/route/api/v1/repo_repo.go — issueTracker() (line 400), wiki() (line 437), mirrorSync() (line 463) CWE - CWE-863: Incorrect Authorization - CWE-269: Improper Privilege Management Description Th

[![CVE-2026-52808 status](https://www.csirts.com/badge/CVE-2026-52808)](https://www.csirts.com/cve/CVE-2026-52808)