PT-2026-20322 · Gogs · Gogs

Spingarbor · Published 2026-02-17 · Updated 2026-03-03 · CVE-2026-25232

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Gogs versions 0.13.4 and below

Description Gogs, an open-source self-hosted Git service, contains an access control bypass issue. Repository collaborators with Write permissions can delete protected branches, including the default branch, by sending a direct POST request. This bypasses the branch protection mechanism, enabling privilege escalation from Write to Admin level. The vulnerability exists in the DeleteBranchPost function within the internal/route/repo/branch.go file, specifically lines 110-155. The web interface deletion operation does not trigger Git Hooks, which correctly prevent protected branch deletion via SSH push. Attackers must have write permissions to the target repository and access to the Gogs web interface to exploit this issue. The vulnerable code lacks checks for protected and default branches, while the UI layer and Git Hooks correctly implement these checks. The vulnerable API endpoint is '/delete/*' and the vulnerable parameter is the branch name.

Recommendations Versions prior to 0.14.1 are affected. Update to version 0.14.1 or later to resolve this vulnerability.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-25232

GHSA-2C6V-8R3V-GH6P

GO-2026-4498

SUSE-SU-2026:0757-1

Affected Products

Gogs

References · 117

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/25xxx/CVE-2026-25232.json · Exploit
• https://github.com/gogs/gogs/commit/7b7e38c88007a7c482dbf31efff896185fd9b79c · Patch
• https://github.com/gogs/gogs/security/advisories/GHSA-2c6v-8r3v-gh6p · Vendor Advisory
• https://osv.dev/vulnerability/GO-2026-4498 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-25232 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2c6v-8r3v-gh6p · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-25232 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0757-1 · Vendor Advisory
• https://github.com/gogs/gogs/releases/tag/v0.14.1 · Note
• https://github.com/gogs/gogs/pull/8124 · Note
• https://github.com/gogs/gogs · Note
• https://suse.com/security/cve/CVE-2017-18912 · Note
• https://suse.com/security/cve/CVE-2025-14435 · Note
• https://suse.com/security/cve/CVE-2026-24122 · Note
• https://suse.com/security/cve/CVE-2026-26205 · Note