CVE-2026-25229

MEDIUM

6.5

Description

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.

CVE Details

CVSS v3.1 Score6.5

SeverityMEDIUM

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published2/19/2026

Last Modified2/19/2026

Sourcenvd

Honeypot Sightings0

Affected Products

gogs:gogs

Weaknesses (CWE)

CWE-284

References

https://github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2(security-advisories@github.com)

https://github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4gh(security-advisories@github.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.