CVE-2026-25229

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks. The vulnerability exists in the Web UI's label update endpoint POST /:username/:reponame/labels/edit. The handler function UpdateLabel uses an incorrect database query function that bypasses repository ownership validation. This issue has been fixed in version 0.14.1.

• CWE-284

• https://github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2Patch
• https://github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4ghExploit, Mitigation, Vendor Advisory

Published

Feb 19, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25221PolarLearn is a free and open-source learning program. In 0-…8.1
• CVE-2026-25222PolarLearn is a free and open-source learning program. In 0-…7.5
• CVE-2026-25223Fastify is a fast and low overhead web framework, for Node.j…7.5
• CVE-2026-25224Fastify is a fast and low overhead web framework, for Node.j…3.7
• CVE-2026-25227authentik is an open-source identity provider. From 2021.3.1…7.2
• CVE-2026-25228Signal K Server is a server application that runs on a centr…4.3
• CVE-2026-2523A vulnerability was detected in Open5GS up to 2.7.6. The aff…7.5
• CVE-2026-25230FileRise is a self-hosted web file manager / WebDAV server. …5.4
• CVE-2026-25231FileRise is a self-hosted web file manager / WebDAV server. …7.5
• CVE-2026-25232Gogs is an open source self-hosted Git service. Versions 0.1…8.8
• CVE-2026-25233PEAR is a framework and distribution system for reusable PHP…9.1
• CVE-2026-25234PEAR is a framework and distribution system for reusable PHP…9.8