GHSA-rjv5-9px2-fqw6: Gogs has authorization bypass in repository deletion API
SummaryThe DELETE /api/v1/repos/:owner/:repo endpoint lacks necessary permission validation middleware. Consequently, any user with read access (including read-only collaborators) can delete the entire repository.This vulnerability stems from the API route configuration only utilizing the repoAssignment() middleware (which only verifies read access) without enforcing reqRepoOwner() or reqRepoAdmin().Detailsvulnerability location:Vulnerable Endpoint：DELETE /api/v1/repos/:owner/:repoRouting configuration file: internal/route/api/v1/api.go (approximately line 253)Function handling file: internal/route/api/v1/repo/repo.go (approximately lines 320-338)Root Cause AnalysisCode Location 1: API Route Configuration (internal/route/api/v1/api.go ~ line 253)Code Location 2: Delete Function Implementation (internal/route/api/v1/repo/repo.go ~ lines 320-338)Missing Permission Check
Comparison with route configurations for other sensitive operations:Data Flow PathAPI Request Path: DELETE /api/v1/repos/:owner/:repoRoute Handling: The outer middleware repoAssignment() verifies that the user has read access (Passed).Execution: The system directly executes the repo.Delete() function.Permission Check: The reqRepoOwner() middleware check is missing.Internal Validation: There is no permission validation inside the Delete() function either.Result: Any user with read permission can delete the repository.PoCPrerequisitesA running Gogs instance.The attacker's account is added as a collaborator to the target repository (Read access is sufficient).The attacker possesses a valid API access token.The target repository exists and is accessible.📜 Test Steps (Bash)Verify Gogs service is running
curl -I http://localhost:10880Create test accounts and repositoryOwner account: owner / owner123456Read-only account: victim / victim123456Test repository: owner/delete-test
<img width="1580" height="832" alt="image" src="https://github.com/user-attachments/assets/d1babac8-d952-4765-ba34-d4891c12b8db" />Add 'victim' as a read-only collaborator
Perform this via the Web UI or API
<img width="1597" height="725" alt="image" src="https://github.com/user-attachments/assets/f76db1d4-9e45-4a97-af22-50db124ec4d0" />
<img width="1597" height="760" alt="image" src="https://github.com/user-attachments/assets/f6ef3bd9-47d4-4202-bf10-2022be557f16" />Obtain API token for 'victim'
curl -X POST http://localhost:10880/api/v1/users/victim/tokens \
-u victim:victim123456 \
-H "Content-Type: application/json" \
-d '{"name":"test-token"}'Resource deleted
<img width="1602" height="483" alt="image" src="https://github.com/user-attachments/assets/3e77aaaa-ffbc-4521-be4b-9a62f36499ff" />
Web UI：Target repository deletion successful
<img width="1581" height="853" alt="image" src="https://github.com/user-attachments/assets/fbd6b4a4-c874-44f9-9b6e-765371eddcc7" />📜 PoC ScriptImpactVulnerability Type: Broken Access Control (CWE-284)Description: A critical authorization bypass vulnerability exists in the Gogs API. The access control mechanism fails to properly validate permissions for destructive operations.Consequences: An authenticated attacker with low-level privileges (e.g., a collaborator with Read-Only access) can exploit this vulnerability to issue unauthorized DELETE requests. This allows the attacker to permanently delete entire repositories, resulting in the immediate loss of all source code, git history, issues, and wiki documentation.Severity: This vulnerability poses a critical risk to data integrity and availability, potentially leading to irreversible data loss and significant operational disruption for affected organizations.The Core Risk: Privilege Escalation & Data Destruction The most critical aspect of this vulnerability is the violation of the Principle of Least Privilege. It allows a user with the lowest level of access (Read-Only) to execute the most destructive action possible (Delete).
CVSS v4.0: 5.7