{"schema_version":"1.7.3","id":"GHSA-jj5m-h57j-5gv7","published":"2026-02-17T18:40:44Z","modified":"2026-02-23T19:41:02.818353Z","aliases":["CVE-2026-25120","GO-2026-4501"],"summary":"Gogs Allows Cross-Repository Comment Deletion via DeleteComment","details":"# IDOR: Cross-Repository Comment Deletion via DeleteComment\n\n## Summary\n\nThe `POST /:owner/:repo/issues/comments/:id/delete` endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| Affected File | `internal/route/repo/issue.go` |\n| Affected Function | `DeleteComment` (lines 955-968) |\n| Secondary File | `internal/database/comment.go` |\n| Secondary Function | `DeleteCommentByID` (lines 505-520) |\n\n## Root Cause\n\nThe vulnerability exists due to insufficient authorization validation in the comment deletion flow:\n\n### 1. Missing Repository Ownership Check in DeleteComment\n\nIn `internal/route/repo/issue.go`, the function retrieves a comment by ID without verifying repository ownership:\n\n```go\nfunc DeleteComment(c *context.Context) {\n    comment, err := database.GetCommentByID(c.ParamsInt64(\":id\"))\n    if err != nil {\n        c.NotFoundOrError(err, \"get comment by ID\")\n        return\n    }\n\n    // Only checks if user is comment poster OR admin of the CURRENT repo (from URL)\n    if c.UserID() != comment.PosterID && !c.Repo.IsAdmin() {\n        c.NotFound()\n        return\n    } else if comment.Type != database.CommentTypeComment {\n        c.Status(http.StatusNoContent)\n        return\n    }\n\n    // No verification that comment.IssueID belongs to c.Repo.Repository.ID!\n    if err = database.DeleteCommentByID(c.User, comment.ID); err != nil {\n        c.Error(err, \"delete comment by ID\")\n        return\n    }\n\n    c.Status(http.StatusOK)\n}\n```\n\n### 2. Database Layer Performs No Authorization\n\nIn `internal/database/comment.go`, the deletion function performs no repository validation:\n\n```go\nfunc DeleteCommentByID(doer *User, id int64) error {\n    comment, err := GetCommentByID(id)\n    if err != nil {\n        if IsErrCommentNotExist(err) {\n            return nil\n        }\n        return err\n    }\n\n    // Directly deletes without checking repository ownership\n    sess := x.NewSession()\n    defer sess.Close()\n    if err = sess.Begin(); err != nil {\n        return err\n    }\n\n    if _, err = sess.ID(comment.ID).Delete(new(Comment)); err != nil {\n        // ...\n    }\n    // ...\n}\n```\n\n## Proof of Concept\n\n### Prerequisites\n\n1. Two users: **Alice** (attacker) and **Bob** (victim)\n2. Alice is admin of `alice/attacker-repo`\n3. Bob has created an issue with a comment on `bob/victim-repo`\n4. Attacker needs to obtain the comment ID from victim's repository (e.g., ID: 42)\n\n### HTTP Request\n\n```http\nPOST /alice/attacker-repo/issues/comments/42/delete HTTP/1.1\nHost: gogs.example.com\nCookie: i_like_gogs=<alice_session_token>\n\n```","affected":[{"package":{"name":"gogs.io/gogs","ecosystem":"Go","purl":"pkg:golang/gogs.io/gogs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.14.0"}]}],"database_specific":{"last_known_affected_version_range":"<= 0.13.4","source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/02/GHSA-jj5m-h57j-5gv7/GHSA-jj5m-h57j-5gv7.json"}}],"references":[{"type":"WEB","url":"https://github.com/gogs/gogs/security/advisories/GHSA-jj5m-h57j-5gv7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-25120"},{"type":"WEB","url":"https://github.com/gogs/gogs/commit/1b226ca48dc8b3e95cc1c41229d72819c960a1b7"},{"type":"PACKAGE","url":"https://github.com/gogs/gogs"}],"database_specific":{"cwe_ids":["CWE-639"],"github_reviewed":true,"github_reviewed_at":"2026-02-17T18:40:44Z","nvd_published_at":"2026-02-19T07:17:45Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N"}]}