CVE-2026-25229
Medium · 6.5CVSS
6.5
EPSS
0.3%
Published
Feb 19, 2026
CISA due date
—
The record
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | gogs.io/gogs | 0 | No fix |
| Go | gogs.io/gogs | 0 | 0.14.0 |
| openSUSE:Leap 15.6 | govulncheck-vulndb | 0 | 0.0.20260226T182644-150000.1.149.1 |
Related vulnerabilities
- GO-2026-4499 Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs in… Same vulnerability
- GO-2026-4501 Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs Also affects gogs.io/gogs
- GO-2026-4498 Gogs has a Protected Branch Deletion Bypass in Web Interface in gogs.io/gogs Also affects gogs.io/gogs
- GO-2026-4500 Unauthenticated File Upload in Gogs in gogs.io/gogs Also affects gogs.io/gogs
- CVE-2026-25232 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- CVE-2026-25242 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- CVE-2026-25120 Gogs is an open source self-hosted Git service. Also affects gogs.io/gogs
- GO-2026-4452 Gogs vulnerable to arbitrary file deletion via Path Traversal in wiki page update in… Also affects gogs.io/gogs