Skip to content
OpenAdvisories
High WID-SEC-2026-0423 4 CVEs

Gogs: Mehrere Schwachstellen

Published Feb 15, 2026 · Updated Feb 15, 2026 · de-DE

Summary

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Administratorrechte zu erlangen.

Product

Gogs ist ein einfacher Git-Server.

Vulnerabilities 4

  • High 7.1
    CVE-2026-25232 Public exploit

    Gogs has a Protected Branch Deletion Bypass in Web Interface

    Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a dire…

    Gogs Gogs gogs.io/gogs Go
  • Medium 6.9
    CVE-2026-25242

    Gogs allows unauthenticated file uploads

    Gogs is an open source self-hosted Git service. Versions 0.13.4 and below expose unauthenticated file upload endpoints by default. When the global RequireSigninView setting is disabled (default), any remote user can upload arbitrary files to the server via /r…

    Gogs Gogs gogs.io/gogs Go
  • Medium 5.3
    CVE-2026-25229

    Gogs Authorization Bypass Allows Cross-Repository Label Modification

    Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have a broken access control vulnerability which allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel functio…

    Gogs Gogs gogs.io/gogs Go
  • Medium 5.1
    CVE-2026-25120

    Gogs Allows Cross-Repository Comment Deletion via DeleteComment

    Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repos…

    Gogs Gogs gogs.io/gogs Go

Revision history

  1. #1

    Initiale Fassung

References