CVE-2026-25229 Gogs Authorization Bypass Allows Cross-Repository Label Modification
Authenticated users can modify labels in repositories they do not own due to missing ownership validation in the label update endpoint.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-25229?
CVE-2026-25229 is a medium-severity missing authorization vulnerability in gogs, published on 19 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.
Weakness: CWE-284
Which versions are affected by CVE-2026-25229?
3 open source packages ship an affected version, including gogs.io/gogs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
gogs.io/gogs Go | All versions | None |
gogs.io/gogs Go | All versions | 0.14.0 |
gogs.io/gogs Go | All versions | 0.14.0 |
Products include Gogs Gogs.
How do I fix CVE-2026-25229?
Upgrade gogs.io/gogs to 0.14.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2026-25229 being exploited?
There is no known exploitation of CVE-2026-25229 in the wild and no public exploit code.
Other vulnerabilities in gogs
Sources
Also known as GHSA-cv22-72px-f4gh, GO-2026-4499.