CVE-2026-25120

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.

• CWE-639

• https://github.com/gogs/gogs/commit/1b226ca48dc8b3e95cc1c41229d72819c960a1b7Patch
• https://github.com/gogs/gogs/security/advisories/GHSA-jj5m-h57j-5gv7Exploit, Vendor Advisory

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25115n8n is an open source workflow automation platform. Prior to…9.9
• CVE-2026-25116Runtipi is a personal homeserver orchestrator. Starting in v…8.8
• CVE-2026-25117pwn.college DOJO is an education platform for learning cyber…8.3
• CVE-2026-25118immich is a high performance self-hosted photo and video man…7.5
• CVE-2026-25119Gogs is an open source self-hosted Git service. Prior to 0.1…7.7
• CVE-2026-2512The Code Embed plugin for WordPress is vulnerable to Stored …6.4
• CVE-2026-25121apko allows users to build and publish OCI container images …7.5
• CVE-2026-25122apko allows users to build and publish OCI container images …5.5
• CVE-2026-25123Homarr is an open-source dashboard. Prior to 1.52.0, a publi…5.3
• CVE-2026-25124OpenEMR is a free and open source electronic health records …6.5
• CVE-2026-25125October is a Content Management System (CMS) and web platfor…4.9
• CVE-2026-25126PolarLearn is a free and open-source learning program. Prior…7.1