This vulnerability is a broken access control flaw that allows an authenticated user who has write permission on any repository to modify labels belonging to other repositories. The flaw resides in the Web UI label update endpoint where the system fails to validate that the label being altered actually belongs to the repository in the URL. As a result, a malicious user could change labels across repositories, potentially undermining project organization, filtering, or reporting mechanisms. The weakness is a classic authorization bypass (CWE‑284).

The affected product is Gogs, an open source self‑hosted Git service. Versions 0.13.4 and earlier are susceptible to the exploit. The issue was remedied in version 0.14.1, which reintroduced proper repository ownership checks on the label update handler.

The severity of the flaw is moderate with a CVSS score of 5.3, and the EPSS score indicates a very low probability of exploitation (<1%). It is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user with write access to any repository. Such a user can issue a POST request to /:username/:reponame/labels/edit and target labels from other repositories because the ownership validation is bypassed. No additional prerequisites or conditions are apparent from the data, so the vulnerability requires only legitimate repository write permissions and the ability to perform HTTP requests to the web interface.