The flaw in Gogs allows a repository administrator to delete comments that belong to other repositories through the DeleteComment API. The API fails to validate that the comment ID belongs to the repository indicated in the request URL, enabling an authorized user to remove any comment in the system by providing an arbitrary ID. This results in loss of audit trail and potential removal of evidence or legitimate user feedback, and is a classic missing access control (CWE‑639).

The affected product is Gogs, the self‑hosted Git service developed by gogs, in all released versions 0.13.4 and earlier. The issue was resolved in version 0.14.0, so any deployment running the older release is vulnerable.

The CVSS score of 5.1 indicates a moderate impact, and the EPSS value of less than 1% shows a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog, meaning no publicly known exploit has been reported. Attackers would need to be repository administrators on a Gogs instance and must know or discover an unrelated comment ID; the attack is performed via a standard HTTP API call, so it can be executed by a remote party that has administrative credentials.