CVE-2026-25229: Gogs has an Authorization Bypass Allows Cross-Repository Label Modification in Gogs

February 17, 2026 (updated February 19, 2026)

A broken access control vulnerability in Gogs allows authenticated users with write access to any repository to modify labels belonging to other repositories. The UpdateLabel function in the Web UI (internal/route/repo/issue.go) fails to verify that the label being modified belongs to the repository specified in the URL path, enabling cross-repository label tampering attacks.

References

github.com/advisories/GHSA-cv22-72px-f4gh
github.com/gogs/gogs
github.com/gogs/gogs/commit/643a6d6353cb6a182a4e1f0720228727f30a3ad2
github.com/gogs/gogs/security/advisories/GHSA-cv22-72px-f4gh
nvd.nist.gov/vuln/detail/CVE-2026-25229

Code Behaviors & Features

Detect and mitigate CVE-2026-25229 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →