CVE-2026-25120: 
Gogs vulnerability analysis and mitigation

CVE-2026-25120 is an Insecure Direct Object Reference (IDOR) vulnerability in Gogs, an open-source self-hosted Git service, that allows a repository administrator to delete issue comments from any repository on the same Gogs instance by supplying arbitrary comment IDs. The flaw affects Gogs versions 0.13.4 and below; version 0.14.0 contains the fix. It was disclosed on February 14, 2026, and published to the GitHub Advisory Database on February 17, 2026. The vulnerability carries a CVSS v3.1 base score of 2.7 (Low) and a CVSS v4.0 base score of 5.1 (Medium) (GitHub Advisory, Gogs Advisory).

The root cause is classified as CWE-639 (Authorization Bypass Through User-Controlled Key). The DeleteComment function in internal/route/repo/issue.go (lines 955–968) retrieves a comment solely by its numeric ID from the URL parameter without verifying that the comment's associated issue belongs to the repository specified in the request URL. The authorization check only confirms whether the requester is the comment's original poster or an administrator of the repository named in the URL — it does not cross-check comment.IssueID against c.Repo.Repository.ID. The database-layer function DeleteCommentByID in internal/database/comment.go (lines 505–520) similarly performs no repository ownership validation before executing the deletion. The fix, introduced in commit 1b226ca, adds an intermediate lookup of the issue by comment.IssueID and rejects the request if issue.RepoID does not match the current repository's ID (GitHub Advisory, Patch Commit).

Successful exploitation allows a repository administrator to permanently delete issue comments from any other repository on the same Gogs instance, bypassing all cross-repository authorization controls. The primary impact is an integrity loss — legitimate discussion content, bug reports, or audit trails in victim repositories can be silently destroyed. There is no confidentiality impact (no data is read or exfiltrated), and availability impact is limited to the loss of the deleted comment data (GitHub Advisory, Gogs Advisory).

Public proof-of-concept exploit details are included in the official security advisory, demonstrating the attack with a simple HTTP POST request. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.036% (4th percentile), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Gogs Advisory).

1. Reconnaissance: Identify a Gogs instance running version 0.13.4 or below. Confirm the attacker controls or has administrator access to at least one repository on that instance (e.g., alice/attacker-repo).
2. Identify target comment ID: Browse or enumerate issues in the victim's repository (e.g., bob/victim-repo) to obtain the numeric comment ID of the comment to be deleted (e.g., ID 42). Comment IDs are sequential integers and may be discoverable via the Gogs web UI or API.
3. Craft the malicious request: Construct an HTTP POST request targeting the attacker's own repository URL but supplying the victim's comment ID:

POST /alice/attacker-repo/issues/comments/42/delete HTTP/1.1
Host: gogs.example.com
Cookie: i_like_gogs=<attacker_session_token>

4. Submit the request: Send the request. Because the DeleteComment function only verifies that the requester is an admin of alice/attacker-repo (which they are) without checking that comment ID 42 belongs to that repository, the server proceeds to delete the comment from bob/victim-repo.
5. Verify deletion: Confirm the comment has been removed from the victim repository's issue thread (GitHub Advisory, Gogs Advisory).

• Network/HTTP Logs: POST requests to /<owner>/<repo>/issues/comments/<id>/delete where the comment ID does not correspond to any comment in the specified repository; repeated such requests with incrementing or arbitrary comment IDs from the same session.
• Application Logs: Gogs access logs showing successful (HTTP 200) DELETE comment responses for comment IDs that belong to repositories other than the one in the URL path.
• Database: Unexpected deletion of comment records where the associated issue.repo_id does not match the repository referenced in the HTTP request path; gaps in sequential comment IDs within issue threads.
• Behavioral: A repository administrator account making comment deletion requests against repositories they do not own or administer (GitHub Advisory).

Upgrade Gogs to version 0.14.0 or later, which includes the fix introduced in commit 1b226ca that adds repository ownership validation before processing comment deletions. No configuration-based workaround is available; the only effective remediation is upgrading to the patched version. Organizations unable to upgrade immediately should consider restricting repository administrator privileges to trusted users only, and monitoring HTTP access logs for anomalous cross-repository comment deletion patterns (Gogs Advisory, Patch Commit).

The vulnerability was reported by the researcher tenbbughunters and published by the Gogs maintainer unknwon on February 14, 2026. No significant broader media coverage or notable community commentary beyond the official advisory has been identified at this time.