What is the CVSS score of CVE-2026-25120?

CVE-2026-25120 has a CVSS 3.1 base score of 2.7 (Low). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Gogs are affected by CVE-2026-25120?

CVE-2026-25120 is a low-severity vulnerability in Gogs (CVSS 2.7). The limited severity suggests constrained impact, typically requiring specific conditions or local access for exploitation.. A patch is available.

Is there a public PoC exploit available for CVE-2026-25120?

Yes, a public proof-of-concept exploit is available for CVE-2026-25120. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-25120?

During next maintenance window: Apply vendor patches when convenient. Vendor patch is available.

Gogs CVE-2026-25120

LOW

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-02-19 security-advisories@github.com

GHSA-jj5m-h57j-5gv7

Authentication Bypass Gogs

2.7

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

2.7 LOW

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:03 vuln.today

PoC Detected

Feb 19, 2026 - 19:48 vuln.today

Public exploit code

Patch released

Feb 19, 2026 - 19:48 nvd

Patch available

CVE Published

Feb 19, 2026 - 07:17 nvd

LOW 2.7

DescriptionGitHub Advisory

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls. The DeleteComment function retrieves a comment by ID without verifying repository ownership and the Database function DeleteCommentByID performs no repository validation. This issue has been fixed in version 0.14.0.

AnalysisAI

Gogs is an open source self-hosted Git service. In versions 0.13.4 and below, the DeleteComment API does not verify that the comment belongs to the repository specified in the URL. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Vulnerability AssessmentAI

Risk Assessment	CVSS 2.7 (LOW). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker (requires authentication) could exploit this vulnerability to compromise the affected system.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

During next maintenance window: Apply vendor patches when convenient. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-25120 vulnerability details – vuln.today

Back

Gogs CVE-2026-25120

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code