Authorization Bypass in Gogs Git Service Affects Multiple Versions
CVE-2026-25120

5.1MEDIUM

Key Information:

Vendor

Gogs

Status
Gogs
Vendor
CVE Published:
19 February 2026

What is CVE-2026-25120?

Gogs, an open-source self-hosted Git service, is affected by a significant vulnerability that allows unauthorized deletion of comments across repositories. In versions up to 0.13.4, the DeleteComment API does not adequately verify that a comment belongs to the specified repository, enabling administrators to manipulate comment data from any repository using arbitrary comment IDs. This issue stems from a lack of repository ownership validation in both the DeleteComment function and the underlying Database function, DeleteCommentByID. It is crucial for users to upgrade to version 0.14.0 or later to mitigate this risk and secure their repositories against unauthorized actions.

Affected Version(s)

gogs < 0.14.0

References

https://github.com/gogs/gogs/security/advisories/GHSA-jj5...
x_refsource_CONFIRM
https://github.com/gogs/gogs/commit/1b226ca48dc8b3e95cc1c...
x_refsource_MISC

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.