Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-25229 Details

Description

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2	[email protected]	Patch
https://github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4gh	[email protected]	ExploitMitigationVendor Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-284	Improper Access Control	[email protected]

Affected Products

Product	Versions
gogs gogs	< 0.14.1
CPE cpe:2.3:a:gogs:gogs:::::::: Remediation No remediation found in references.

Change History

4 change records found show changes

Date	Action	Recorded By
Jun 17, 2026	CVE Modified	[email protected]
Jun 17, 2026	CVE Modified	CISA-ADP
Feb 19, 2026	Initial Analysis	[email protected]
Feb 19, 2026	New CVE Received	[email protected]