Gogs Authorization Bypass Allows Cross-Repository Label Modification
Description
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
gogs.io/gogsGo | < 0.14.0 | 0.14.0 |
Affected products
1Patches
1643a6d6353cbrepo: improve authz for resources
3 files changed · +61 −1
internal/route/api/v1/repo/issue_comment.go+22 −0 modified@@ -88,6 +88,17 @@ func EditIssueComment(c *context.APIContext, form api.EditIssueCommentOption) { return } + issue, err := database.GetIssueByID(comment.IssueID) + if err != nil { + c.NotFoundOrError(err, "get issue by ID") + return + } + + if issue.RepoID != c.Repo.Repository.ID { + c.NotFound() + return + } + if c.User.ID != comment.PosterID && !c.Repo.IsAdmin() { c.Status(http.StatusForbidden) return @@ -112,6 +123,17 @@ func DeleteIssueComment(c *context.APIContext) { return } + issue, err := database.GetIssueByID(comment.IssueID) + if err != nil { + c.NotFoundOrError(err, "get issue by ID") + return + } + + if issue.RepoID != c.Repo.Repository.ID { + c.NotFound() + return + } + if c.User.ID != comment.PosterID && !c.Repo.IsAdmin() { c.Status(http.StatusForbidden) return
internal/route/api/v1/repo/key.go+17 −1 modified@@ -45,6 +45,11 @@ func GetDeployKey(c *context.APIContext) { return } + if key.RepoID != c.Repo.Repository.ID { + c.NotFound() + return + } + if err = key.GetContent(); err != nil { c.Error(err, "get content") return @@ -94,7 +99,18 @@ func CreateDeployKey(c *context.APIContext, form api.CreateKeyOption) { // https://github.com/gogs/go-gogs-client/wiki/Repositories-Deploy-Keys#remove-a-deploy-key func DeleteDeploykey(c *context.APIContext) { - if err := database.DeleteDeployKey(c.User, c.ParamsInt64(":id")); err != nil { + key, err := database.GetDeployKeyByID(c.ParamsInt64(":id")) + if err != nil { + c.NotFoundOrError(err, "get deploy key by ID") + return + } + + if key.RepoID != c.Repo.Repository.ID { + c.NotFound() + return + } + + if err := database.DeleteDeployKey(c.User, key.ID); err != nil { if database.IsErrKeyAccessDenied(err) { c.ErrorStatus(http.StatusForbidden, errors.New("You do not have access to this key")) } else {
internal/route/repo/issue.go+22 −0 modified@@ -926,6 +926,17 @@ func UpdateCommentContent(c *context.Context) { return } + issue, err := database.GetIssueByID(comment.IssueID) + if err != nil { + c.NotFoundOrError(err, "get issue by ID") + return + } + + if issue.RepoID != c.Repo.Repository.ID { + c.NotFound() + return + } + if c.UserID() != comment.PosterID && !c.Repo.IsAdmin() { c.NotFound() return @@ -959,6 +970,17 @@ func DeleteComment(c *context.Context) { return } + issue, err := database.GetIssueByID(comment.IssueID) + if err != nil { + c.NotFoundOrError(err, "get issue by ID") + return + } + + if issue.RepoID != c.Repo.Repository.ID { + c.NotFound() + return + } + if c.UserID() != comment.PosterID && !c.Repo.IsAdmin() { c.NotFound() return
Vulnerability mechanics
Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-cv22-72px-f4ghghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-25229ghsaADVISORY
- github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2ghsax_refsource_MISCWEB
- github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4ghghsax_refsource_CONFIRMWEB
News mentions
0No linked articles in our index yet.