CVE-2026-25120 MEDIUM

CVE-2026-25120: Gogs Allows Cross-Repository Comment Deletion via DeleteComment

Vendor Gogs

Product gogs

Weakness CWE-639 · IDOR

Published February 19, 2026

Last update February 19, 2026

View on NVD All CVEs

CVSS base score

5.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.

Key dates

02Disclosure timeline

February 19, 2026 CVE published

February 19, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-25120 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/639.html