CVE-2026-25921
Published: 05 March 2026
Summary
CVE-2026-25921 is a critical-severity Insufficient Verification of Data Authenticity (CWE-345) vulnerability in Gogs Gogs. Its CVSS base score is 9.3 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 9.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 requires timely flaw remediation, directly addressing this CVE by mandating upgrades to Gogs version 0.14.2 or later to patch the overwritable LFS object vulnerability.
AC-3 enforces approved authorizations for access to system resources, preventing unauthenticated attackers from overwriting LFS objects across repositories.
SI-7 employs integrity checks to detect unauthorized modifications to LFS objects, mitigating supply-chain attacks by identifying tampered binary files before use.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated exploit against public-facing Git service (T1190) directly enables stored LFS object overwrite, mapping to stored data manipulation (T1565.001) for integrity compromise and supply-chain injection.
NVD Description
Gogs is an open source self-hosted Git service. Prior to version 0.14.2, overwritable LFS object across different repos leads to supply-chain attack, all LFS objects are vulnerable to be maliciously overwritten by malicious attackers. This issue has been patched in…
more
version 0.14.2.
Deeper analysisAI
CVE-2026-25921 affects Gogs, an open source self-hosted Git service, in versions prior to 0.14.2. The vulnerability stems from overwritable Git Large File Storage (LFS) objects across different repositories, enabling malicious overwriting of all LFS objects. This flaw, classified under CWE-345 (Insufficient Verification of Data Authenticity), carries a CVSS v3.1 base score of 9.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L), indicating critical severity due to high integrity impact with changed scope.
Unauthenticated remote attackers can exploit this vulnerability over the network with low complexity and no user interaction. By overwriting LFS objects in arbitrary repositories, attackers enable supply-chain attacks, potentially injecting malicious content into repositories used by other users or organizations, compromising the integrity of large binary files without affecting confidentiality or causing significant availability disruption.
The issue has been addressed in Gogs version 0.14.2, as detailed in the project's security advisory (GHSA-cj4v-437j-jq4c), release notes, associated pull request (#8166), and patching commit (81ee8836445ac888d99da8b652be7d5cbc5c4d5c). Security practitioners should prioritize upgrading to version 0.14.2 or later to mitigate the risk.
Details
- CWE(s)