Vulnerability-Lookup

GHSA-2C6V-8R3V-GH6P

Vulnerability from github – Published: 2026-02-17 18:43 – Updated: 2026-02-19 21:14

Summary

Gogs has a Protected Branch Deletion Bypass in Web Interface

Details

Summary

An access control bypass vulnerability in Gogs web interface allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability enables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only.

Although Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms.

Details

Affected Component

File: internal/route/repo/branch.go
Function: DeleteBranchPost (lines 110-155)
Route Configuration: internal/cmd/web.go:589 go m.Post("/delete/*", reqSignIn, reqRepoWriter, repo.DeleteBranchPost)

Root Cause

The DeleteBranchPost function performs the following checks when deleting a branch: 1. ✅ User authentication (reqSignIn) 2. ✅ Write permission check (reqRepoWriter) 3. ✅ Branch existence verification 4. ✅ CommitID matching (optional parameter) 5. ❌ Missing protected branch check 6. ❌ Missing default branch check

While the UI layer (internal/route/repo/issue.go:646-658) correctly checks protected branch status and hides the delete button, attackers can directly construct POST requests to bypass UI restrictions.

Vulnerable Code

Vulnerable implementation (internal/route/repo/branch.go:110-155):

```110:155:internal/route/repo/branch.go func DeleteBranchPost(c context.Context) { branchName := c.Params("") commitID := c.Query("commit")

defer func() {
    redirectTo := c.Query("redirect_to")
    if !tool.IsSameSiteURLPath(redirectTo) {
        redirectTo = c.Repo.RepoLink
    }
    c.Redirect(redirectTo)
}()

if !c.Repo.GitRepo.HasBranch(branchName) {
    return
}
if len(commitID) > 0 {
    branchCommitID, err := c.Repo.GitRepo.BranchCommitID(branchName)
    if err != nil {
        log.Error("Failed to get commit ID of branch %q: %v", branchName, err)
        return
    }

    if branchCommitID != commitID {
        c.Flash.Error(c.Tr("repo.pulls.delete_branch_has_new_commits"))
        return
    }
}

// 🔴 Vulnerability: Missing protected branch check here
// Should add check like:
// protectBranch, err := database.GetProtectBranchOfRepoByName(c.Repo.Repository.ID, branchName)
// if protectBranch != nil && protectBranch.Protected { ... }

if err := c.Repo.GitRepo.DeleteBranch(branchName, git.DeleteBranchOptions{
    Force: true,
}); err != nil {
    log.Error("Failed to delete branch %q: %v", branchName, err)
    return
}

if err := database.PrepareWebhooks(c.Repo.Repository, database.HookEventTypeDelete, &api.DeletePayload{
    Ref:        branchName,
    RefType:    "branch",
    PusherType: api.PUSHER_TYPE_USER,
    Repo:       c.Repo.Repository.APIFormatLegacy(nil),
    Sender:     c.User.APIFormat(),
}); err != nil {
    log.Error("Failed to prepare webhooks for %q: %v", database.HookEventTypeDelete, err)
    return
}

}


**Correct implementation in Git Hook** (`internal/cmd/hook.go:122-125`):

```go
// check and deletion
if newCommitID == git.EmptyID {
    fail(fmt.Sprintf("Branch '%s' is protected from deletion", branchName), "")
}

Correct UI layer check (internal/route/repo/issue.go:646-658):

protectBranch, err := database.GetProtectBranchOfRepoByName(pull.BaseRepoID, pull.HeadBranch)
if err != nil {
    if !database.IsErrBranchNotExist(err) {
        c.Error(err, "get protect branch of repository by name")
        return
    }
} else {
    branchProtected = protectBranch.Protected
}

c.Data["IsPullBranchDeletable"] = pull.BaseRepoID == pull.HeadRepoID &&
    c.Repo.IsWriter() && c.Repo.GitRepo.HasBranch(pull.HeadBranch) &&
    !branchProtected  // UI layer has check, but backend doesn't

PoC

Prerequisites

Have Write permissions to the target repository (collaborator or team member)
Target repository has protected branches configured (e.g., main, master, develop)
Access to Gogs web interface

Send Malicious POST Request

# Directly send DELETE request bypassing UI protection
curl -X POST \
  -b cookies.txt \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "_csrf=YOUR_CSRF_TOKEN" \
  "https://gogs.example.com/username/repo/branches/delete/main"

Impact

Bypass branch protection mechanism: The core function of protected branches is to prevent deletion, and this vulnerability completely undermines this mechanism
Delete default branch: Can cause repository to become inaccessible (git clone/pull failures)
Bypass code review: After deleting protected branch, can push new branch bypassing Pull Request requirements
Privilege escalation: Writer permission users can perform operations that should only be allowed for Admins

Severity ?

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "gogs.io/gogs"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.14.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25232"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-17T18:43:00Z",
    "nvd_published_at": "2026-02-19T07:17:45Z",
    "severity": "HIGH"
  },
  "details": "## Summary\n\nAn access control bypass vulnerability in Gogs web interface allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability enables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only.\n\nAlthough Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms.\n\n## Details\n\n### Affected Component\n\n- **File**: `internal/route/repo/branch.go`\n- **Function**: `DeleteBranchPost` (lines 110-155)\n- **Route Configuration**: `internal/cmd/web.go:589`\n  ```go\n  m.Post(\"/delete/*\", reqSignIn, reqRepoWriter, repo.DeleteBranchPost)\n  ```\n\n### Root Cause\n\nThe `DeleteBranchPost` function performs the following checks when deleting a branch:\n1. \u2705 User authentication (`reqSignIn`)\n2. \u2705 Write permission check (`reqRepoWriter`)\n3. \u2705 Branch existence verification\n4. \u2705 CommitID matching (optional parameter)\n5. \u274c **Missing protected branch check**\n6. \u274c **Missing default branch check**\n\nWhile the UI layer (`internal/route/repo/issue.go:646-658`) correctly checks protected branch status and hides the delete button, attackers can directly construct POST requests to bypass UI restrictions.\n\n### Vulnerable Code\n\n**Vulnerable implementation** (`internal/route/repo/branch.go:110-155`):\n\n```110:155:internal/route/repo/branch.go\nfunc DeleteBranchPost(c *context.Context) {\n\tbranchName := c.Params(\"*\")\n\tcommitID := c.Query(\"commit\")\n\n\tdefer func() {\n\t\tredirectTo := c.Query(\"redirect_to\")\n\t\tif !tool.IsSameSiteURLPath(redirectTo) {\n\t\t\tredirectTo = c.Repo.RepoLink\n\t\t}\n\t\tc.Redirect(redirectTo)\n\t}()\n\n\tif !c.Repo.GitRepo.HasBranch(branchName) {\n\t\treturn\n\t}\n\tif len(commitID) \u003e 0 {\n\t\tbranchCommitID, err := c.Repo.GitRepo.BranchCommitID(branchName)\n\t\tif err != nil {\n\t\t\tlog.Error(\"Failed to get commit ID of branch %q: %v\", branchName, err)\n\t\t\treturn\n\t\t}\n\n\t\tif branchCommitID != commitID {\n\t\t\tc.Flash.Error(c.Tr(\"repo.pulls.delete_branch_has_new_commits\"))\n\t\t\treturn\n\t\t}\n\t}\n\n\t// \ud83d\udd34 Vulnerability: Missing protected branch check here\n\t// Should add check like:\n\t// protectBranch, err := database.GetProtectBranchOfRepoByName(c.Repo.Repository.ID, branchName)\n\t// if protectBranch != nil \u0026\u0026 protectBranch.Protected { ... }\n\n\tif err := c.Repo.GitRepo.DeleteBranch(branchName, git.DeleteBranchOptions{\n\t\tForce: true,\n\t}); err != nil {\n\t\tlog.Error(\"Failed to delete branch %q: %v\", branchName, err)\n\t\treturn\n\t}\n\n\tif err := database.PrepareWebhooks(c.Repo.Repository, database.HookEventTypeDelete, \u0026api.DeletePayload{\n\t\tRef:        branchName,\n\t\tRefType:    \"branch\",\n\t\tPusherType: api.PUSHER_TYPE_USER,\n\t\tRepo:       c.Repo.Repository.APIFormatLegacy(nil),\n\t\tSender:     c.User.APIFormat(),\n\t}); err != nil {\n\t\tlog.Error(\"Failed to prepare webhooks for %q: %v\", database.HookEventTypeDelete, err)\n\t\treturn\n\t}\n}\n```\n\n**Correct implementation in Git Hook** (`internal/cmd/hook.go:122-125`):\n\n```go\n// check and deletion\nif newCommitID == git.EmptyID {\n    fail(fmt.Sprintf(\"Branch \u0027%s\u0027 is protected from deletion\", branchName), \"\")\n}\n```\n\n**Correct UI layer check** (`internal/route/repo/issue.go:646-658`):\n\n```go\nprotectBranch, err := database.GetProtectBranchOfRepoByName(pull.BaseRepoID, pull.HeadBranch)\nif err != nil {\n\tif !database.IsErrBranchNotExist(err) {\n\t\tc.Error(err, \"get protect branch of repository by name\")\n\t\treturn\n\t}\n} else {\n\tbranchProtected = protectBranch.Protected\n}\n\nc.Data[\"IsPullBranchDeletable\"] = pull.BaseRepoID == pull.HeadRepoID \u0026\u0026\n\tc.Repo.IsWriter() \u0026\u0026 c.Repo.GitRepo.HasBranch(pull.HeadBranch) \u0026\u0026\n\t!branchProtected  // UI layer has check, but backend doesn\u0027t\n```\n## PoC\n\n### Prerequisites\n\n1. Have Write permissions to the target repository (collaborator or team member)\n2. Target repository has protected branches configured (e.g., main, master, develop)\n3. Access to Gogs web interface\n\n#### Send Malicious POST Request\n```bash\n# Directly send DELETE request bypassing UI protection\ncurl -X POST \\\n  -b cookies.txt \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"_csrf=YOUR_CSRF_TOKEN\" \\\n  \"https://gogs.example.com/username/repo/branches/delete/main\"\n```\n\u003cimg width=\"1218\" height=\"518\" alt=\"image\" src=\"https://github.com/user-attachments/assets/745da7c3-6139-408c-9747-ccbe9ea8548f\" /\u003e\n\n## Impact\n- **Bypass branch protection mechanism**: The core function of protected branches is to prevent deletion, and this vulnerability completely undermines this mechanism\n- **Delete default branch**: Can cause repository to become inaccessible (git clone/pull failures)\n- **Bypass code review**: After deleting protected branch, can push new branch bypassing Pull Request requirements\n- **Privilege escalation**: Writer permission users can perform operations that should only be allowed for Admins",
  "id": "GHSA-2c6v-8r3v-gh6p",
  "modified": "2026-02-19T21:14:56Z",
  "published": "2026-02-17T18:43:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/security/advisories/GHSA-2c6v-8r3v-gh6p"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/pull/8124"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/commit/7b7e38c88007a7c482dbf31efff896185fd9b79c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gogs/gogs"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gogs/gogs/releases/tag/v0.14.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Gogs has a Protected Branch Deletion Bypass in Web Interface"
}

CVE-2026-25232 (GCVE-0-2026-25232)

Vulnerability from cvelistv5 – Published: 2026-02-19 02:25 – Updated: 2026-02-19 17:44

Title

Gogs has a Protected Branch Deletion Bypass in Web Interface

Summary

Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability in the DeleteBranchPost function eenables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only. Although Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms. In oder to exploit this vulnerability, attackers must have write permissions to the target repository, protected branches configured to the target repository and access to the Gogs web interface. This issue has been fixed in version 0.14.1.

Severity ?

7.1 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

CWE

CWE-863 - Incorrect Authorization

Assigner

GitHub_M

References

URL

Tags

	https://github.com/gogs/gogs/security/advisories/…	x_refsource_CONFIRM
	https://github.com/gogs/gogs/pull/8124	x_refsource_MISC
	https://github.com/gogs/gogs/commit/7b7e38c88007a…	x_refsource_MISC
	https://github.com/gogs/gogs/releases/tag/v0.14.1	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	gogs	gogs	Affected: < 0.14.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-25232",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-02-19T17:04:55.043252Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-02-19T17:44:52.867Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "gogs",
          "vendor": "gogs",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 0.14.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Gogs is an open source self-hosted Git service. Versions 0.13.4 and below have an access control bypass vulnerability which allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability in the DeleteBranchPost function eenables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only. Although Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms. In oder to exploit this vulnerability, attackers must have write permissions to the target repository, protected branches configured to the target repository and access to the Gogs web interface. This issue has been fixed in version 0.14.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-863",
              "description": "CWE-863: Incorrect Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-02-19T02:25:34.039Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/gogs/gogs/security/advisories/GHSA-2c6v-8r3v-gh6p",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/gogs/gogs/security/advisories/GHSA-2c6v-8r3v-gh6p"
        },
        {
          "name": "https://github.com/gogs/gogs/pull/8124",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gogs/gogs/pull/8124"
        },
        {
          "name": "https://github.com/gogs/gogs/commit/7b7e38c88007a7c482dbf31efff896185fd9b79c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gogs/gogs/commit/7b7e38c88007a7c482dbf31efff896185fd9b79c"
        },
        {
          "name": "https://github.com/gogs/gogs/releases/tag/v0.14.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/gogs/gogs/releases/tag/v0.14.1"
        }
      ],
      "source": {
        "advisory": "GHSA-2c6v-8r3v-gh6p",
        "discovery": "UNKNOWN"
      },
      "title": "Gogs has a Protected Branch Deletion Bypass in Web Interface"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-25232",
    "datePublished": "2026-02-19T02:25:34.039Z",
    "dateReserved": "2026-01-30T14:44:47.328Z",
    "dateUpdated": "2026-02-19T17:44:52.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-2C6V-8R3V-GH6P

Summary

Details

Affected Component

Root Cause

Vulnerable Code

PoC

Prerequisites

Send Malicious POST Request

Impact

CVE-2026-25232 (GCVE-0-2026-25232)

Tags

Sightings

Nomenclature