CVE-2026-25229
Description
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.
How to fix
- gogs gogs0.14.1 or later
- gogs.io/gogs0.14.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| gogs gogs | v < 0.14.1 | 0.14.1 |
| gogs.io/gogsGo | v < 0.14.0, No range specified | 0.14.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.