VYPR
Moderate severityNVD Advisory· Published Feb 19, 2026· Updated Feb 19, 2026

Gogs Authorization Bypass Allows Cross-Repository Label Modification

CVE-2026-25229

Description

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
gogs.io/gogsGo
< 0.14.00.14.0

Affected products

1

Patches

1
643a6d6353cb

repo: improve authz for resources

https://github.com/gogs/gogsJoe ChenJan 30, 2026via ghsa
3 files changed · +61 1
  • internal/route/api/v1/repo/issue_comment.go+22 0 modified
    @@ -88,6 +88,17 @@ func EditIssueComment(c *context.APIContext, form api.EditIssueCommentOption) {
     		return
     	}
     
    +	issue, err := database.GetIssueByID(comment.IssueID)
    +	if err != nil {
    +		c.NotFoundOrError(err, "get issue by ID")
    +		return
    +	}
    +
    +	if issue.RepoID != c.Repo.Repository.ID {
    +		c.NotFound()
    +		return
    +	}
    +
     	if c.User.ID != comment.PosterID && !c.Repo.IsAdmin() {
     		c.Status(http.StatusForbidden)
     		return
    @@ -112,6 +123,17 @@ func DeleteIssueComment(c *context.APIContext) {
     		return
     	}
     
    +	issue, err := database.GetIssueByID(comment.IssueID)
    +	if err != nil {
    +		c.NotFoundOrError(err, "get issue by ID")
    +		return
    +	}
    +
    +	if issue.RepoID != c.Repo.Repository.ID {
    +		c.NotFound()
    +		return
    +	}
    +
     	if c.User.ID != comment.PosterID && !c.Repo.IsAdmin() {
     		c.Status(http.StatusForbidden)
     		return
    
  • internal/route/api/v1/repo/key.go+17 1 modified
    @@ -45,6 +45,11 @@ func GetDeployKey(c *context.APIContext) {
     		return
     	}
     
    +	if key.RepoID != c.Repo.Repository.ID {
    +		c.NotFound()
    +		return
    +	}
    +
     	if err = key.GetContent(); err != nil {
     		c.Error(err, "get content")
     		return
    @@ -94,7 +99,18 @@ func CreateDeployKey(c *context.APIContext, form api.CreateKeyOption) {
     
     // https://github.com/gogs/go-gogs-client/wiki/Repositories-Deploy-Keys#remove-a-deploy-key
     func DeleteDeploykey(c *context.APIContext) {
    -	if err := database.DeleteDeployKey(c.User, c.ParamsInt64(":id")); err != nil {
    +	key, err := database.GetDeployKeyByID(c.ParamsInt64(":id"))
    +	if err != nil {
    +		c.NotFoundOrError(err, "get deploy key by ID")
    +		return
    +	}
    +
    +	if key.RepoID != c.Repo.Repository.ID {
    +		c.NotFound()
    +		return
    +	}
    +
    +	if err := database.DeleteDeployKey(c.User, key.ID); err != nil {
     		if database.IsErrKeyAccessDenied(err) {
     			c.ErrorStatus(http.StatusForbidden, errors.New("You do not have access to this key"))
     		} else {
    
  • internal/route/repo/issue.go+22 0 modified
    @@ -926,6 +926,17 @@ func UpdateCommentContent(c *context.Context) {
     		return
     	}
     
    +	issue, err := database.GetIssueByID(comment.IssueID)
    +	if err != nil {
    +		c.NotFoundOrError(err, "get issue by ID")
    +		return
    +	}
    +
    +	if issue.RepoID != c.Repo.Repository.ID {
    +		c.NotFound()
    +		return
    +	}
    +
     	if c.UserID() != comment.PosterID && !c.Repo.IsAdmin() {
     		c.NotFound()
     		return
    @@ -959,6 +970,17 @@ func DeleteComment(c *context.Context) {
     		return
     	}
     
    +	issue, err := database.GetIssueByID(comment.IssueID)
    +	if err != nil {
    +		c.NotFoundOrError(err, "get issue by ID")
    +		return
    +	}
    +
    +	if issue.RepoID != c.Repo.Repository.ID {
    +		c.NotFound()
    +		return
    +	}
    +
     	if c.UserID() != comment.PosterID && !c.Repo.IsAdmin() {
     		c.NotFound()
     		return
    

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

4

News mentions

0

No linked articles in our index yet.