Vulnerability · Published Feb 19, 2026 · Assigned by GitHub_M
CVE-2026-25229Gogs Authorization Bypass Allows Cross-Repository Label Modification
Medium 5.3
In plain English
A medium-severity improper access control in gogs from gogs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | gogs.io/gogs | 0.14.0 | GHSA-cv22-72px-f4gh |
| Go | gogs.io/gogs | no fix listed | GO-2026-4499 |
Affected products (as reported)
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References
- https://github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4gh x_refsource_CONFIRM
- https://github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2 x_refsource_MISC