CVE-2026-25229

Katalog CVE

CVSS 6.5 · Medium EPSS 0,27%

Kerentanan Improper Access Control pada gogs. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.

Rincian

Terbit di NVD

19 Februari 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-284: Improper Access Control

EPSS (30 hari)

0,27% peluang dieksploitasi; lebih tinggi dari 17,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4gh exploit · mitigasi · advisory vendor
• https://github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2 patch