CVE-2026-25120
published 2026-02-19CVE-2026-25120: Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository…
PriorityP416low2.7CVSS 3.1
AVNACLPRHUINSUCNILAN
EPSS
0.30%
22.1th percentile
Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| gogs.io | gogs | >= 0 < 0.14.0 | 0.14.0 |
| gogs | gogs | < 0.14.0 | 0.14.0 |
CVSS provenance
nvdv3.12.7LOWCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
nvdv4.05.1MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs
osv·2026-02-23
CVE-2026-25120 Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs
Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs
Gogs Allows Cross-Repository Comment Deletion via DeleteComment in gogs.io/gogs.
NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions.
(If this is causing false-positive reports from vulnerability scanners, please suggest an edit to the report.)
The additional affected modules and versions are: gogs.io/gogs before v0.14.0.
OSV
Gogs Allows Cross-Repository Comment Deletion via DeleteComment
osv·2026-02-17
CVE-2026-25120 [MEDIUM] Gogs Allows Cross-Repository Comment Deletion via DeleteComment
Gogs Allows Cross-Repository Comment Deletion via DeleteComment
# IDOR: Cross-Repository Comment Deletion via DeleteComment
## Summary
The `POST /:owner/:repo/issues/comments/:id/delete` endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.
## Vulnerability Details
| Field | Value |
|-------|-------|
| Affected File | `internal/route/repo/issue.go` |
| Affected Function | `DeleteComment` (lines 955-968) |
| Secondary File | `internal/database/comment.go` |
| Secondary Function | `DeleteCommentByID` (lines 505-520) |
## Root Cause
The vulnerability exists due to insufficient authorization validati
GHSA
Gogs Allows Cross-Repository Comment Deletion via DeleteComment
ghsa·2026-02-17
CVE-2026-25120 [MEDIUM] CWE-639 Gogs Allows Cross-Repository Comment Deletion via DeleteComment
Gogs Allows Cross-Repository Comment Deletion via DeleteComment
# IDOR: Cross-Repository Comment Deletion via DeleteComment
## Summary
The `POST /:owner/:repo/issues/comments/:id/delete` endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.
## Vulnerability Details
| Field | Value |
|-------|-------|
| Affected File | `internal/route/repo/issue.go` |
| Affected Function | `DeleteComment` (lines 955-968) |
| Secondary File | `internal/database/comment.go` |
| Secondary Function | `DeleteCommentByID` (lines 505-520) |
## Root Cause
The vulnerability exists due to insufficient authorization validati
No detection rules found.
No public exploits indexed.
Wiz
CVE-2026-25120 Impact, Exploitability, and Mitigation Steps | Wiz
blogs_wiz·CVSS 5.1
CVE-2026-25120 [MEDIUM] CVE-2026-25120 Impact, Exploitability, and Mitigation Steps | Wiz
## CVE-2026-25120 :
Gogs vulnerability analysis and mitigation
Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.
Source : NVD
## 5.1
Score
Published February 19, 2026
Severity MEDIUM
CNA Score 5.1
Affected Technologies
Gogs
Has Public Exploit Yes
Has CISA KEV Exploit No
CISA KEV Rele
Bugzilla
CVE-2026-107444 rubygem-katello: katello: katello: Katello Docker Tags repositories API cross-organization authorization bypass
bugzilla·2026-10-08·CVSS 4.3
CVE-2026-107444 [MEDIUM] CVE-2026-107444 rubygem-katello: katello: katello: Katello Docker Tags repositories API cross-organization authorization bypass
CVE-2026-107444 rubygem-katello: katello: katello: Katello Docker Tags repositories API cross-organization authorization bypass
A flaw was found in Katello. The Docker Tags repositories API endpoint resolves a DockerMetaTag with an unscoped find and returns associated repositories without intersecting Repository.readable. An authenticated user with view_products permission in one organization can enumerate repository metadata (names, product associations, content types, upstream URLs) for Docker tags belonging to other organizations by supplying the tag identifier and omitting the optional organization filter. Reported via PSIRTSUPT-25120.
2026-02-19
Published