CVE-2026-25232: Gogs.io/gogs Gogs Has A Protected Branch Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2c6v-8r3v-gh6p",
  "modified" : "2026-02-19T21:14:56Z",
  "published" : "2026-02-17T18:43:00Z",
  "aliases" : [ "CVE-2026-25232" ],
  "summary" : "Gogs has a Protected Branch Deletion Bypass in Web Interface",
  "details" : "## Summary\n\nAn access control bypass vulnerability in Gogs web interface allows any repository collaborator with Write permissions to delete protected branches (including the default branch) by sending a direct POST request, completely bypassing the branch protection mechanism. This vulnerability enables privilege escalation from Write to Admin level, allowing low-privilege users to perform dangerous operations that should be restricted to administrators only.\n\nAlthough Git Hook layer correctly prevents protected branch deletion via SSH push, the web interface deletion operation does not trigger Git Hooks, resulting in complete bypass of protection mechanisms.\n\n## Details\n\n### Affected Component\n\n- **File**: `internal/route/repo/branch.go`\n- **Function**: `DeleteBranchPost` (lines 110-155)\n- **Route Configuration**: `internal/cmd/web.go:589`\n  ```go\n  m.Post(\"/delete/*\", reqSignIn, reqRepoWriter, repo.DeleteBranchPost)\n  ```\n\n### Root Cause\n\nThe `DeleteBranchPost` function performs the following checks when deleting a branch:\n1. ✅ User authentication (`reqSignIn`)\n2. ✅ Write permission check (`reqRepoWriter`)\n3. ✅ Branch existence verification\n4. ✅ CommitID matching (optional parameter)\n5. ❌ **Missing protected branch check**\n6. ❌ **Missing default branch check**\n\nWhile the UI layer (`internal/route/repo/issue.go:646-658`) correctly checks protected branch status and hides the delete button, attackers can directly construct POST requests to bypass UI restrictions.\n\n### Vulnerable Code\n\n**Vulnerable implementation** (`internal/route/repo/branch.go:110-155`):\n\n```110:155:internal/route/repo/branch.go\nfunc DeleteBranchPost(c *context.Context) {\n\tbranchName := c.Params(\"*\")\n\tcommitID := c.Query(\"commit\")\n\n\tdefer func() {\n\t\tredirectTo := c.Query(\"redirect_to\")\n\t\tif !tool.IsSameSiteURLPath(redirectTo) {\n\t\t\tredirectTo = c.Repo.RepoLink\n\t\t}\n\t\tc.Redirect(redirectTo)\n\t}()\n\n\tif !c.Repo.GitRepo.HasBranch(branchName) {\n\t\treturn\n\t}\n\tif len(commitID) > 0 {\n\t\tbranchCommitID, err := c.Repo.GitRepo.BranchCommitID(branchName)\n\t\tif err != nil {\n\t\t\tlog.Error(\"Failed to get commit ID of branch %q: %v\", branchName, err)\n\t\t\treturn\n\t\t}\n\n\t\tif branchCommitID != commitID {\n\t\t\tc.Flash.Error(c.Tr(\"repo.pulls.delete_branch_has_new_commits\"))\n\t\t\treturn\n\t\t}\n\t}\n\n\t// 🔴 Vulnerability: Missing protected branch check here\n\t// Should add check like:\n\t// protectBranch, err := database.GetProtectBranchOfRepoByName(c.Repo.Repository.ID, branchName)\n\t// if protectBranch != nil && protectBranch.Protected { ... }\n\n\tif err := c.Repo.GitRepo.DeleteBranch(branchName, git.DeleteBranchOptions{\n\t\tForce: true,\n\t}); err != nil {\n\t\tlog.Error(\"Failed to delete branch %q: %v\", branchName, err)\n\t\treturn\n\t}\n\n\tif err := database.PrepareWebhooks(c.Repo.Repository, database.HookEventTypeDelete, &api.DeletePayload{\n\t\tRef:        branchName,\n\t\tRefType:    \"branch\",\n\t\tPusherType: api.PUSHER_TYPE_USER,\n\t\tRepo:       c.Repo.Repository.APIFormatLegacy(nil),\n\t\tSender:     c.User.APIFormat(),\n\t}); err != nil {\n\t\tlog.Error(\"Failed to prepare webhooks for %q: %v\", database.HookEventTypeDelete, err)\n\t\treturn\n\t}\n}\n```\n\n**Correct implementation in Git Hook** (`internal/cmd/hook.go:122-125`):\n\n```go\n// check and deletion\nif newCommitID == git.EmptyID {\n    fail(fmt.Sprintf(\"Branch '%s' is protected from deletion\", branchName), \"\")\n}\n```\n\n**Correct UI layer check** (`internal/route/repo/issue.go:646-658`):\n\n```go\nprotectBranch, err := database.GetProtectBranchOfRepoByName(pull.BaseRepoID, pull.HeadBranch)\nif err != nil {\n\tif !database.IsErrBranchNotExist(err) {\n\t\tc.Error(err, \"get protect branch of repository by name\")\n\t\treturn\n\t}\n} else {\n\tbranchProtected = protectBranch.Protected\n}\n\nc.Data[\"IsPullBranchDeletable\"] = pull.BaseRepoID == pull.HeadRepoID &&\n\tc.Repo.IsWriter() && c.Repo.GitRepo.HasBranch(pull.HeadBranch) &&\n\t!branchProtected  // UI layer has check, but backend doesn't\n```\n## PoC\n\n### Prerequisites\n\n1. Have Write permissions to the target repository (collaborator or team member)\n2. Target repository has protected branches configured (e.g., main, master, develop)\n3. Access to Gogs web interface\n\n#### Send Malicious POST Request\n```bash\n# Directly send DELETE request bypassing UI protection\ncurl -X POST \\\n  -b cookies.txt \\\n  -H \"Content-Type: application/x-www-form-urlencoded\" \\\n  -d \"_csrf=YOUR_CSRF_TOKEN\" \\\n  \"https://gogs.example.com/username/repo/branches/delete/main\"\n```\n<img width=\"1218\" height=\"518\" alt=\"image\" src=\"https://github.com/user-attachments/assets/745da7c3-6139-408c-9747-ccbe9ea8548f\" />\n\n## Impact\n- **Bypass branch protection mechanism**: The core function of protected branches is to prevent deletion, and this vulnerability completely undermines this mechanism\n- **Delete default branch**: Can cause repository to become inaccessible (git clone/pull failures)\n- **Bypass code review**: After deleting protected branch, can push new branch bypassing Pull Request requirements\n- **Privilege escalation**: Writer permission users can perform operations that should only be allowed for Admins",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "gogs.io/gogs"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "0.14.1"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/security/advisories/GHSA-2c6v-8r3v-gh6p"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-25232"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/pull/8124"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/commit/7b7e38c88007a7c482dbf31efff896185fd9b79c"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/gogs/gogs"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/gogs/gogs/releases/tag/v0.14.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-863" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-02-17T18:43:00Z",
    "nvd_published_at" : "2026-02-19T07:17:45Z"
  }
}