CVE-2026-25120 – Gogs Allows Cross-Repository Comment Deletion via DeleteComment

CVE ID : CVE-2026-25120

Published : Feb. 19, 2026, 1:59 a.m. | 1 hour ago

Description : Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.

Severity: 0.0 | NA

Visit the link for more details, such as CVSS details, affected products, timeline, and more…