CVE-2026-25232: 
Gogs vulnerability analysis and mitigation

CVE-2026-25232 is an access control bypass vulnerability in Gogs, an open-source self-hosted Git service, that allows repository collaborators with Write permissions to delete protected branches (including the default branch) by sending a direct POST request to the web interface. The vulnerability affects Gogs versions 0.13.4 and below, and was disclosed on February 14, 2026, with a patch released in version 0.14.1. It carries a CVSS v3.1 base score of 8.8 (High) and a CVSS v4.0 base score of 7.1 (High) (Github Advisory, Gogs Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): the DeleteBranchPost function in internal/route/repo/branch.go (lines 110–155) correctly validates user authentication and Write permissions but omits checks for whether the target branch is protected or is the repository's default branch. The route m.Post("/delete/*", reqSignIn, reqRepoWriter, repo.DeleteBranchPost) is accessible to any authenticated Write-level collaborator. While the UI layer (internal/route/repo/issue.go:646-658) hides the delete button for protected branches, and the Git Hook layer blocks deletion via SSH push, neither protection applies to direct POST requests to the web endpoint — creating a complete backend bypass. An attacker must possess Write-level repository access, the target repository must have protected branches configured, and the attacker must have access to the Gogs web interface (Github Advisory, Patch Commit).

Successful exploitation allows a Write-level collaborator to delete any protected branch, including the default branch, effectively escalating their privileges to Admin-level operations. Deleting the default branch can render the repository inaccessible (causing git clone/pull failures), disrupt CI/CD pipelines, and destroy critical development history. Additionally, after removing a protected branch, an attacker could push a new branch bypassing Pull Request and code review requirements, potentially introducing malicious code into the repository (Gogs Advisory, Github Advisory).

A proof-of-concept exploit is publicly available on GitHub (PoC Repository), and the advisory itself includes a working curl-based PoC. There is no evidence of active in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (4th percentile), indicating a currently low probability of exploitation in the next 30 days (Github Advisory, Gogs Advisory).

1. Reconnaissance: Identify a Gogs instance running version 0.13.4 or below. Confirm the target repository has protected branches (e.g., main, master, develop) and that you hold Write-level collaborator access.
2. Obtain a valid session and CSRF token: Log in to the Gogs web interface with your Write-level account. Capture a valid session cookie (e.g., via browser developer tools) and extract the _csrf token from any repository page form.
3. Craft the malicious POST request: Construct a direct POST request to the branch deletion endpoint, bypassing the UI restriction:

curl -X POST \
  -b cookies.txt \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "_csrf=YOUR_CSRF_TOKEN" \
  "https://gogs.example.com/username/repo/branches/delete/main"

4. Confirm deletion: Verify the protected branch (e.g., main) has been deleted by checking the repository's branch list or attempting a git fetch. The deletion bypasses all branch protection rules enforced at the UI and Git Hook layers (Gogs Advisory, Github Advisory).

• Network: Unexpected HTTP POST requests to /<username>/<repo>/branches/delete/<branch-name> originating from non-admin user accounts, particularly targeting branches named main, master, or develop.
• Logs: Gogs web server access logs showing POST requests to /branches/delete/ endpoints by Write-level users; webhook delivery logs for delete events on protected branches triggered unexpectedly.
• Application Behavior: Protected or default branches disappearing from the repository without a corresponding admin action or SSH push event; git clone or git pull failures due to missing default branch.
• Audit Trail: Branch deletion events attributed to non-admin collaborators in repository activity logs (Gogs Advisory).

Upgrade Gogs to version 0.14.1 or later, which adds explicit checks in DeleteBranchPost to block deletion of both the default branch and any protected branch before processing the request (Gogs Release, Patch Commit). For organizations unable to patch immediately, restrict Write-level access to repositories containing protected branches to only fully trusted users, and limit network access to the Gogs web interface. Additionally, monitor web server logs for unexpected POST requests to /branches/delete/ endpoints as a compensating control (Github Advisory).

The vulnerability was reported by researcher spingARbor and disclosed by Gogs maintainer unknwon on February 14, 2026. Social media coverage was noted on Mastodon and Bluesky via TheHackerWire, and the vulnerability was picked up by aggregators including RedPacket Security and LinuxSecurity. No major vendor statements beyond the official Gogs advisory have been issued, and community reaction has been moderate given the limited scope to self-hosted Gogs deployments (Gogs Advisory).