Only lastest two minor version releases are supported for patching security fixes.
Please send report privately to security@gogs.io, and include how would you like to be credited.
Thank you!