Common Weakness Enumeration
CWE-639
AllowedAuthorization Bypass Through User-Controlled Key
Abstraction: Base · Status: Incomplete
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
4247 vulnerabilities reference this CWE, most recent first.
GHSA-JFWP-6M6H-2WGW
Vulnerability from github – Published: 2025-10-18 09:30 – Updated: 2025-10-18 09:30
VLAI
Details
The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2025-11517"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-18T07:15:35Z",
"severity": "HIGH"
},
"details": "The Event Tickets and Registration plugin for WordPress is vulnerable to payment bypass in all versions up to, and including, 5.26.5. This is due to the /wp-json/tribe/tickets/v1/commerce/free/order endpoint not verifying that a ticket type should be free allowing the user to bypass the payment. This makes it possible for unauthenticated attackers to obtain access to paid tickets, without paying for them, causing a loss of revenue for the target.",
"id": "GHSA-jfwp-6m6h-2wgw",
"modified": "2025-10-18T09:30:50Z",
"published": "2025-10-18T09:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-11517"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3378214/event-tickets/tags/5.26.6/src/Tickets/Commerce/Gateways/Free/REST/Order_Endpoint.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/21cd8cb8-2a29-4b66-ab7a-8d8b2f85e2e0?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JFX4-P2CG-248G
Vulnerability from github – Published: 2024-11-12 21:30 – Updated: 2024-11-12 21:30
VLAI
Details
An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacker to interact with ressources of other organizations via HTTP or HTTPS requests.
Severity
5.4 (Medium)
{
"affected": [],
"aliases": [
"CVE-2023-47543"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-12T19:15:07Z",
"severity": "MODERATE"
},
"details": "An authorization bypass through user-controlled key vulnerability [CWE-639] in Fortinet FortiPortal version 7.0.0 through 7.0.3 allows an authenticated attacker to interact with ressources of other organizations via HTTP or HTTPS requests.",
"id": "GHSA-jfx4-p2cg-248g",
"modified": "2024-11-12T21:30:51Z",
"published": "2024-11-12T21:30:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47543"
},
{
"type": "WEB",
"url": "https://fortiguard.fortinet.com/psirt/FG-IR-23-448"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JG8P-J9V5-G5X5
Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-25 12:31
VLAI
Details
OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-66013"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-25T11:17:19Z",
"severity": "CRITICAL"
},
"details": "OpenRemote before 1.26.2 contains an authentication bypass vulnerability in the console registration API that allows unauthenticated attackers to update existing console assets by supplying a known asset identifier. Attackers can overwrite push notification tokens and console metadata without authentication or ownership validation, redirecting notifications or denying delivery to legitimate consoles.",
"id": "GHSA-jg8p-j9v5-g5x5",
"modified": "2026-07-25T12:31:39Z",
"published": "2026-07-25T12:31:39Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openremote/openremote/security/advisories/GHSA-gpfc-h59v-63cv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-66013"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/openremote-before-authentication-bypass-via-console-registration"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JGFQ-MGXG-4QWM
Vulnerability from github – Published: 2026-01-27 09:30 – Updated: 2026-07-20 12:32
VLAI
Details
The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization‑internal privilege escalation.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-21721"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-01-27T09:15:48Z",
"severity": "HIGH"
},
"details": "The dashboard permissions API does not verify the target dashboard scope and only checks the dashboards.permissions:* action. As a result, a user who has permission management rights on one dashboard can read and modify permissions on other dashboards. This is an organization\u2011internal privilege escalation.",
"id": "GHSA-jgfq-mgxg-4qwm",
"modified": "2026-07-20T12:32:07Z",
"published": "2026-01-27T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2914"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:2920"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3078"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:3529"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:40138"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:41064"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:5633"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2026:8229"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2433242"
},
{
"type": "WEB",
"url": "https://grafana.com/security/security-advisories/CVE-2026-21721"
},
{
"type": "WEB",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-21721.json"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JGG6-7GQ8-598M
Vulnerability from github – Published: 2026-02-10 15:30 – Updated: 2026-06-05 15:32
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers.This issue affects Dinibh Patrol Tracking System: through 10022026.
NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-7347"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-10T15:16:05Z",
"severity": "HIGH"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in Dinibh Puzzle Software Solutions Dinibh Patrol Tracking System allows Exploitation of Trusted Identifiers.This issue affects Dinibh Patrol Tracking System: through 10022026.\n\nNOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-jgg6-7gq8-598m",
"modified": "2026-06-05T15:32:07Z",
"published": "2026-02-10T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7347"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-26-0051"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-26-0051"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JH23-V8PG-3GXQ
Vulnerability from github – Published: 2025-03-14 06:30 – Updated: 2025-03-14 06:30
VLAI
Details
The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user's identity prior to updating their password through the account_settings_save_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user's passwords, including administrators, and leverage that to gain access to their account.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2024-11284"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-14T05:15:40Z",
"severity": "CRITICAL"
},
"details": "The WP JobHunt plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 6.9. This is due to the plugin not properly validating a user\u0027s identity prior to updating their password through the account_settings_save_callback() function. This makes it possible for unauthenticated attackers to change arbitrary user\u0027s passwords, including administrators, and leverage that to gain access to their account.",
"id": "GHSA-jh23-v8pg-3gxq",
"modified": "2025-03-14T06:30:42Z",
"published": "2025-03-14T06:30:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-11284"
},
{
"type": "WEB",
"url": "https://themeforest.net/item/jobcareer-job-board-responsive-wordpress-theme/14221636"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8afe386e-1e4f-4668-8309-6d47dedb008a?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JHCW-2W66-F34V
Vulnerability from github – Published: 2026-07-30 18:31 – Updated: 2026-07-31 21:31
VLAI
Details
A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that returns the records of other users without checking that the caller owns the data associated with that record.
Severity
8.1 (High)
{
"affected": [],
"aliases": [
"CVE-2026-15658"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-30T16:16:56Z",
"severity": "HIGH"
},
"details": "A vulnerability in the foreUP customer REST API allows any authenticated, low-privilege customer to access an endpoint that\nreturns the records of other users without checking that the caller owns the data associated with that record.",
"id": "GHSA-jhcw-2w66-f34v",
"modified": "2026-07-31T21:31:52Z",
"published": "2026-07-30T18:31:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15658"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/790363"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JHVX-775R-CM5M
Vulnerability from github – Published: 2026-09-03 15:32 – Updated: 2026-09-03 15:32
VLAI
Details
Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants' cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.
Severity
{
"affected": [],
"aliases": [
"CVE-2026-85211"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-03T15:17:40Z",
"severity": "HIGH"
},
"details": "Label Studio fails to apply organization filters when resolving storage URIs for tasks and projects in proxy_api.py endpoints. Attackers can access other tenants\u0027 cloud storage objects by creating a separate organization and supplying arbitrary file URIs to presign or stream bucket contents.",
"id": "GHSA-jhvx-775r-cm5m",
"modified": "2026-09-03T15:32:26Z",
"published": "2026-09-03T15:32:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-85211"
},
{
"type": "WEB",
"url": "https://github.com/HumanSignal/label-studio/issues/9924"
},
{
"type": "WEB",
"url": "https://github.com/HumanSignal/label-studio"
},
{
"type": "WEB",
"url": "https://github.com/HumanSignal/label-studio/blob/1.23.0/label_studio/io_storages/proxy_api.py"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/label-studio-through-1.23.0-cross-organization-storage-uri-resolution"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-JHW3-VP8X-97C7
Vulnerability from github – Published: 2025-02-25 15:34 – Updated: 2026-04-01 18:33
VLAI
Details
Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Amelia: from n/a through 1.2.16.
Severity
5.3 (Medium)
{
"affected": [],
"aliases": [
"CVE-2025-26965"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-25T15:15:29Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key vulnerability in ameliabooking Amelia allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Amelia: from n/a through 1.2.16.",
"id": "GHSA-jhw3-vp8x-97c7",
"modified": "2026-04-01T18:33:50Z",
"published": "2025-02-25T15:34:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26965"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/ameliabooking/vulnerability/wordpress-amelia-plugin-1-2-16-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JJ5M-H57J-5GV7
Vulnerability from github – Published: 2026-02-17 18:40 – Updated: 2026-02-19 21:14
VLAI
Summary
Gogs Allows Cross-Repository Comment Deletion via DeleteComment
Details
IDOR: Cross-Repository Comment Deletion via DeleteComment
Summary
The POST /:owner/:repo/issues/comments/:id/delete endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.
Vulnerability Details
| Field | Value |
|---|---|
| Affected File | internal/route/repo/issue.go |
| Affected Function | DeleteComment (lines 955-968) |
| Secondary File | internal/database/comment.go |
| Secondary Function | DeleteCommentByID (lines 505-520) |
Root Cause
The vulnerability exists due to insufficient authorization validation in the comment deletion flow:
1. Missing Repository Ownership Check in DeleteComment
In internal/route/repo/issue.go, the function retrieves a comment by ID without verifying repository ownership:
func DeleteComment(c *context.Context) {
comment, err := database.GetCommentByID(c.ParamsInt64(":id"))
if err != nil {
c.NotFoundOrError(err, "get comment by ID")
return
}
// Only checks if user is comment poster OR admin of the CURRENT repo (from URL)
if c.UserID() != comment.PosterID && !c.Repo.IsAdmin() {
c.NotFound()
return
} else if comment.Type != database.CommentTypeComment {
c.Status(http.StatusNoContent)
return
}
// No verification that comment.IssueID belongs to c.Repo.Repository.ID!
if err = database.DeleteCommentByID(c.User, comment.ID); err != nil {
c.Error(err, "delete comment by ID")
return
}
c.Status(http.StatusOK)
}
2. Database Layer Performs No Authorization
In internal/database/comment.go, the deletion function performs no repository validation:
func DeleteCommentByID(doer *User, id int64) error {
comment, err := GetCommentByID(id)
if err != nil {
if IsErrCommentNotExist(err) {
return nil
}
return err
}
// Directly deletes without checking repository ownership
sess := x.NewSession()
defer sess.Close()
if err = sess.Begin(); err != nil {
return err
}
if _, err = sess.ID(comment.ID).Delete(new(Comment)); err != nil {
// ...
}
// ...
}
Proof of Concept
Prerequisites
- Two users: Alice (attacker) and Bob (victim)
- Alice is admin of
alice/attacker-repo - Bob has created an issue with a comment on
bob/victim-repo - Attacker needs to obtain the comment ID from victim's repository (e.g., ID: 42)
HTTP Request
POST /alice/attacker-repo/issues/comments/42/delete HTTP/1.1
Host: gogs.example.com
Cookie: i_like_gogs=<alice_session_token>
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.13.4"
},
"package": {
"ecosystem": "Go",
"name": "gogs.io/gogs"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.14.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-25120"
],
"database_specific": {
"cwe_ids": [
"CWE-639"
],
"github_reviewed": true,
"github_reviewed_at": "2026-02-17T18:40:44Z",
"nvd_published_at": "2026-02-19T07:17:45Z",
"severity": "MODERATE"
},
"details": "# IDOR: Cross-Repository Comment Deletion via DeleteComment\n\n## Summary\n\nThe `POST /:owner/:repo/issues/comments/:id/delete` endpoint does not verify that the comment belongs to the repository specified in the URL. This allows a repository administrator to delete comments from any other repository by supplying arbitrary comment IDs, bypassing authorization controls.\n\n## Vulnerability Details\n\n| Field | Value |\n|-------|-------|\n| Affected File | `internal/route/repo/issue.go` |\n| Affected Function | `DeleteComment` (lines 955-968) |\n| Secondary File | `internal/database/comment.go` |\n| Secondary Function | `DeleteCommentByID` (lines 505-520) |\n\n## Root Cause\n\nThe vulnerability exists due to insufficient authorization validation in the comment deletion flow:\n\n### 1. Missing Repository Ownership Check in DeleteComment\n\nIn `internal/route/repo/issue.go`, the function retrieves a comment by ID without verifying repository ownership:\n\n```go\nfunc DeleteComment(c *context.Context) {\n comment, err := database.GetCommentByID(c.ParamsInt64(\":id\"))\n if err != nil {\n c.NotFoundOrError(err, \"get comment by ID\")\n return\n }\n\n // Only checks if user is comment poster OR admin of the CURRENT repo (from URL)\n if c.UserID() != comment.PosterID \u0026\u0026 !c.Repo.IsAdmin() {\n c.NotFound()\n return\n } else if comment.Type != database.CommentTypeComment {\n c.Status(http.StatusNoContent)\n return\n }\n\n // No verification that comment.IssueID belongs to c.Repo.Repository.ID!\n if err = database.DeleteCommentByID(c.User, comment.ID); err != nil {\n c.Error(err, \"delete comment by ID\")\n return\n }\n\n c.Status(http.StatusOK)\n}\n```\n\n### 2. Database Layer Performs No Authorization\n\nIn `internal/database/comment.go`, the deletion function performs no repository validation:\n\n```go\nfunc DeleteCommentByID(doer *User, id int64) error {\n comment, err := GetCommentByID(id)\n if err != nil {\n if IsErrCommentNotExist(err) {\n return nil\n }\n return err\n }\n\n // Directly deletes without checking repository ownership\n sess := x.NewSession()\n defer sess.Close()\n if err = sess.Begin(); err != nil {\n return err\n }\n\n if _, err = sess.ID(comment.ID).Delete(new(Comment)); err != nil {\n // ...\n }\n // ...\n}\n```\n\n## Proof of Concept\n\n### Prerequisites\n\n1. Two users: **Alice** (attacker) and **Bob** (victim)\n2. Alice is admin of `alice/attacker-repo`\n3. Bob has created an issue with a comment on `bob/victim-repo`\n4. Attacker needs to obtain the comment ID from victim\u0027s repository (e.g., ID: 42)\n\n### HTTP Request\n\n```http\nPOST /alice/attacker-repo/issues/comments/42/delete HTTP/1.1\nHost: gogs.example.com\nCookie: i_like_gogs=\u003calice_session_token\u003e\n\n```",
"id": "GHSA-jj5m-h57j-5gv7",
"modified": "2026-02-19T21:14:32Z",
"published": "2026-02-17T18:40:44Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/security/advisories/GHSA-jj5m-h57j-5gv7"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25120"
},
{
"type": "WEB",
"url": "https://github.com/gogs/gogs/commit/1b226ca48dc8b3e95cc1c41229d72819c960a1b7"
},
{
"type": "PACKAGE",
"url": "https://github.com/gogs/gogs"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Gogs Allows Cross-Repository Comment Deletion via DeleteComment"
}
Mitigation
Architecture and Design
For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
Mitigation
Architecture and Design
Implementation
Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Mitigation
Architecture and Design
Use encryption in order to make it more difficult to guess other legitimate values of the key or associate a digital signature with the key so that the server can verify that there has been no tampering.
No CAPEC attack patterns related to this CWE.