A critical access control bypass in Gogs allows authenticated repository collaborators to delete protected branches, leading to unauthorized privilege escalation and potential data loss.

The vulnerability exists in the DeleteBranchPost function, where the web interface fails to perform necessary capability checks or trigger Git Hooks during branch deletion. This allows any authenticated user with repository Write access to bypass branch protection mechanisms and perform operations typically reserved for administrators.

The ability for low-privilege users to delete protected branches poses a significant risk to project integrity and development workflows. By bypassing these controls, an attacker can destroy critical source code history or disrupt release processes, leading to potential operational downtime and reputational damage. With a CVSS score of 8.8, this flaw represents a high-severity risk that demands prompt attention.

Immediate Action: Update Gogs to version 0.14.1 or later to implement the necessary authorization checks within the DeleteBranchPost function.

Proactive Monitoring: Review web server access logs for suspicious POST requests targeting the branch deletion endpoints, especially those originating from accounts with standard Write permissions.

Compensating Controls: Implement strict repository access controls and consider using an external Web Application Firewall to monitor and filter unauthorized administrative requests to the Gogs web interface.

Public Exploit Available: Yes, a public proof-of-concept exists as documented in the H1sok444/CVE-2026-25232-PoC GitHub repository.

Given the severity of this access control bypass and the availability of functional proof-of-concept code, administrators should treat this as a high-priority update. Upgrading to version 0.14.1 is the only reliable method to ensure that branch protection mechanisms are correctly enforced and that unauthorized users cannot escalate their privileges to perform destructive actions.