Most recent entries from all

EUVD-2026-268874

fkie_cve-2026-25120

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.

GHSA-jj5m-h57j-5gv7 — Gogs Allows Cross-Repository Comment Deletion via DeleteComment

Affected: Go: gogs.io/gogs

# IDOR: Cross-Repository Comment Deletion via DeleteComment

## Summary

The `POST /:owner/:repo/issues/comments/:id/delete` endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.

## Vulnerability Details

| Field | Value | |-------|-------| | Affected File | `internal/route/repo/issue.go` | | Affected Function | `DeleteComment` (lines 955-968) | | Secondary File | `internal/database/comment.go` | | Secondary Function | `DeleteCommentByID` (lines 505-520) |

## Root Cause

The vulnerability exists due to insufficient authorization validation in the comment deletion flow:

### 1. Missing Repository Ownership Check in DeleteComment

In `internal/route/repo/issue.go`, the function retrieves a comment by ID without verifying repository ownership:

```go func DeleteComment(c *context.Context) { comment, err := database.GetCommentByID(c.ParamsInt64(":id")) if err != nil { c.NotFoundOrError(err, "get comment by ID") return }

// Only checks if user is comment poster OR admin of the CURRENT repo (from URL) if c.UserID() != comment.PosterID && !c.Repo.IsAdmin() { c.NotFound() return } else if comment.Type != database.CommentTypeComment { c.Status(http.StatusNoContent) return }

// No verification that comment.IssueID b…

WID-SEC-W-2026-0423 — Gogs: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Gogs ausnutzen, um Dateien zu manipulieren, Sicherheitsmaßnahmen zu umgehen oder Administratorrechte zu erlangen.