CVE-2020-9329: 
Gogs vulnerability analysis and mitigation

Gogs through version 0.11.91 contains a race condition vulnerability in the internal/db/repo.go file that allows attackers to bypass the administrator-specified repository creation policy. The vulnerability was discovered and disclosed on February 21, 2020 (NVD).

The vulnerability stems from a race condition in the NumRepos field update process, which is not handled in a thread-safe manner. The issue occurs because the row is not locked during repository creation checks, allowing multiple concurrent requests to bypass the MaxCreationLimit restriction. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N (NVD, GitHub Issue).

When exploited, this vulnerability allows attackers to create more repositories than the administrator-specified limit, potentially leading to resource exhaustion and violation of organizational policies (GitHub Issue).

The suggested solutions include implementing optimistic locking for the NumRepos field in the User struct or redesigning the system to count repositories directly from the repository table instead of maintaining a counter in the user table (GitHub Issue).