CVE-2026-25120: Gogs Allows Cross-Repository Comment Deletion via DeleteComment

February 17, 2026 (updated February 19, 2026)

The POST /:owner/:repo/issues/comments/:id/delete endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.

References

github.com/advisories/GHSA-jj5m-h57j-5gv7
github.com/gogs/gogs
github.com/gogs/gogs/commit/1b226ca48dc8b3e95cc1c41229d72819c960a1b7
github.com/gogs/gogs/security/advisories/GHSA-jj5m-h57j-5gv7
nvd.nist.gov/vuln/detail/CVE-2026-25120

Code Behaviors & Features

Detect and mitigate CVE-2026-25120 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →